Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,430 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects common runtime processes (Node.js, npx, Python) often used for Model Context Protocol (MCP) servers accessing sensitive local credential files such as AWS credentials, SSH private keys, or environment files. This behavior is indicative of potential credential harvesting by unauthorized MCP servers in developer environments.
Detects the deletion of GitHub workflow logs that occur in close temporal proximity to sensitive operations such as secret access or package publication. The rule also flags deletions associated with workflow names containing AI-themed keywords, which may indicate an attempt to conceal malicious automation or activity.
Detects instances where AI agent host processes (such as Python, .NET, or IIS worker processes) spawn suspicious child processes like command interpreters or common system utilities. This behavior is indicative of potential Remote Code Execution (RCE) via prompt injection, where an AI agent is manipulated into executing arbitrary system commands.
Detects persistence and execution abuse within hidden IDE/AI assistant workspace directories (e.g., .vscode, .cursor, .claude). The rule monitors for the creation or modification of configuration files used for automated task execution and identifies process execution patterns originating from these directories that invoke downloaders (curl, wget) or decoders (base64) to fetch or execute payloads.
Detects anomalous AWS activity combining bulk secret retrieval from AWS Secrets Manager using the BatchGetSecretValue API with subsequent authentication failures or validation errors in AWS STS. This behavior is indicative of automated credential harvesting pipelines or agentic frameworks rapidly enumerating and testing stolen credentials.
Detects suspicious process command lines that access sensitive cryptocurrency wallet data files or registry keys associated with wallet applications, which is a common behavior of information-stealing malware.
Detects the execution of a renamed DISM binary (index.exe) that subsequently loads a specific DLL (DismCore.dll), which is a common technique used for DLL side-loading to evade security controls by masquerading as a legitimate system utility.
Detects the presence of configuration markers associated with cryptocurrency clipboard-swapping malware. The rule monitors process command lines for specific flags (e.g., 'cclipper', 'clipboard_check_delay') and cryptocurrency wallet address dictionary keys, which are common indicators of malicious software designed to replace legitimate destination wallet addresses copied to the clipboard with attacker-controlled addresses.
Detects the WMI provider host (wmiprvse.exe) spawning common living-off-the-land binaries often associated with command execution or lateral movement.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the command line contains suspicious patterns such as execution of common scripting engines (PowerShell, wscript, cscript), use of common staging directories (temp, appdata, programdata), or naming conventions that mimic legitimate Windows system tasks.
Page 176 of 1168