Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,098 copies47 likes38,487 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects instances where a Node.js process spawns a child process, also running as node.exe, that attempts to execute a specific JavaScript file path (sharedLoad.min.js or its extended version). This behavior is characteristic of certain Node.js-based applications or potentially malicious scripts using shared loaders for modular execution.
Detects Microsoft Entra ID sign-in events where a user authenticates from a known residential proxy ASN, matching the user's historical geography but using a new, unrecognized device fingerprint. This behavior is indicative of session token replay attacks, where an adversary uses stolen session cookies to bypass standard authentication.
Detects the execution of the AnyDesk remote support application when initiated from a web browser (msedge.exe) or the Windows file explorer (explorer.exe). This pattern is often indicative of user-driven execution, potentially as part of a tech support scam or unauthorized remote access attempt.
Detects a Node.js process deleting specific core application files, such as 'index.js' or 'sharedLoad.min.js', located within 'node_modules' directories. This activity may indicate malicious tampering, package integrity compromise, or an adversary attempting to disrupt application functionality.
This rule detects network connections or DNS queries made to suspicious domains that utilize MFA or credential-themed keywords (e.g., 'mfa', 'sso', 'passkey', 'register'). These domains are often used in phishing campaigns to impersonate authentication portals and harvest user credentials or MFA tokens.
Detects network communication with 10729e014d0e.skyleen.fr, associated with the SCKIT malware downloading binaries during CI/CD emitter activities. This rule flags potential ingress tool transfers as part of a supply chain compromise campaign identified as 'memos-semi-nuclear'.
Detects the SCKit Go-based credential-stealing implant found in compromised npm and PyPI packages. The detection logic focuses on unique build-info module paths, specific C2 encryption protocol headers, and embedded campaign identifiers related to 'memos-cloud-openclaw-plugin' and 'MemoryOS' supply chain compromises.
Detects the creation of files or directories under specific paths (/.openclaw/ and /.sckit/) used by the sckit Go-based worm. This worm, distributed via compromised npm and PyPI packages, uses these directories to track state and coordinate execution on infected Linux systems.
This rule monitors application, build system, and dependency scanning logs for references to known-malicious versions of the @memtensor/memos-cloud-openclaw-plugin (npm) and MemoryOS (PyPI) packages. These versions contain the sckit Go worm and are associated with automated supply chain attacks involving the reuse of stolen credentials, indicated by the 'exact-ref-one-use-NPM_TOKEN' marker.
Detects npm package publish events that lack 'gitHead' provenance metadata. The absence of this field indicates that the package was likely published from a developer's local machine rather than through an authorized CI/CD pipeline, a technique used in supply chain attacks to bypass CI-gated controls.
Page 229 of 1168