Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,538 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of the Go runtime invoking a local module ('go run .') initiated by infrastructure-as-code tools like Terraform or standard command-line interpreters. This pattern matches the behavior of the Graphalgo RAT, which uses a hash-gated mechanism within malicious modules to trigger a second-stage payload.
This rule detects network communication (DNS queries and TLS connections) to known actor-controlled Slack workspace subdomains, as well as the presence of a specific hardcoded public key in Slack API traffic, suggesting the use of Slack as a Command and Control (C2) channel.
Detects instances where a Terraform provider process spawns a child process (go.exe or cmd.exe) to execute 'go run .'. This behavior is atypical for standard Terraform provider execution and may indicate the use of malicious providers that compile and execute code on-the-fly, a technique used to evade signature-based detection.
Detects the execution of package management commands (npm, pip, python) within directories or command-line arguments containing 'veltrix' or 'veltrix-capital', which may indicate the use of malicious dependencies or cloned repository lures.
Detects the execution of the KRSID ransomware binary, which is written in Rust. The rule identifies the malware based on its unique file extensions, ransom note filenames, specific command-line arguments, log file indicators, and compiled code characteristics.
Detects the execution of 'git checkout' commands involving 'FETCH_HEAD', initiated by Gemini or Node.js runtime environments. This pattern may indicate automated repository synchronization, potential software supply chain activity, or anomalous usage of developer tools.
Detects Git command line executions involving 'branch', 'checkout', or 'push' operations that reference what appear to be full commit hashes as branch references. The rule flags instances where 'refname is ambiguous' warnings are generated, which may indicate an attempt to manipulate or interact with git repositories in ways that conflict with existing branches, potentially suggesting malicious repository tampering or discovery activity.
Detects anomalous outbound network connections initiated by security and developer tooling (Trivy, Checkmarx, LiteLLM, Telnyx). This behavior is consistent with supply-chain attacks, such as those attributed to the UNC6780/TeamPCP threat group, where compromised tooling is leveraged to exfiltrate sensitive cloud credentials or API keys to external, non-vendor infrastructure.
Detects a suspicious sequence of events where a user engagement (voice/video call) involving themes of urgency or helpdesk interaction is closely followed by a high-risk administrative action (e.g., password reset, MFA device enrollment, or financial transfer) by the same user, where the communication session context differs from standard activity, indicative of a deepfake-enabled vishing attack.
Detects anomalous, rapid execution of a high volume of diverse offensive security tools (scanners, exploitation frameworks, and C2 agents) from a single parent process within a short window, which is characteristic of automated LLM-driven orchestration or scripted attack tool chaining.
Page 300 of 1168