Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,540 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects npm package publication events specifically related to the @dforge-core/dforge-mcp library, including detection of OIDC-based trusted publishing mechanisms to identify potential supply chain compromise or unauthorized releases.
Detects instances where npm.exe or node.exe initiate child node.exe processes, a behavior commonly associated with multi-stage loaders or malicious packages (e.g., GHAPPIER) that execute arbitrary JavaScript payloads during package installation or execution.
Detects instances where a repository's GitHub CI/CD workflow, git configuration, or repository settings are modified, followed shortly thereafter by an npm package publish event. This behavior is indicative of a supply chain compromise where an adversary modifies workflow files to auto-publish malicious versions of a package.
Detects the creation of specific file artifacts and process execution associated with the PIVOTPIPE .NET loader. The rule monitors for the creation of temporary working directories prefixed with 'nb_' in '\Windows\Temp\', the staging of associated configuration and payload files (such as 'agent.json', 'pk.der', 'sleepmask.o', 'core.pak'), and the execution of associated process names like 'netbeacon_pivot.exe', 'pivot_hop2_kasp.exe', or 'x64beacon.exe'.
Detects the creation or modification of known PIVOTPIPE loader artifacts, specifically the 'sleepmask.o' file and related configuration or helper files ('agent.json', 'pk.der', 'core.pak'), within temporary directories prefixed with 'nb_' under the Windows Temp folder. These files are used by the PIVOTPIPE loader to implement sleep-masking techniques that encrypt beacon memory during dormant periods to evade detection.
Detects PowerShell execution containing multiple command-line arguments indicative of environment discovery, such as checking system uptime, hardware specifications, or specific memory-related delays. These patterns are commonly used by malware to detect virtual machines, sandboxes, or analysis environments to alter execution or exit.
Detects suspicious PowerShell activity involving compression commands (e.g., Expand-Archive) within APPDATA, correlated with the execution of hypersnap.exe with hidden window arguments, and the creation of persistence via scheduled tasks. This pattern is indicative of automated staging or malicious tool execution and persistence setup.
Detects a scenario where a single initiating process terminates multiple distinct processes within a short timeframe (5 minutes). This behavioral pattern is often associated with security tool tampering or EDR-evasion techniques where malicious code attempts to identify and terminate defensive security processes.
Detects the creation of specific debug log files by PIVOTPIPE Cobalt Strike-compatible payloads in the Windows temporary directory. These artifacts indicate active post-exploitation activity, specifically operations involving process token manipulation or impersonation.
Detects processes attempting to interact with the Anti-Malware Scan Interface (AMSI) via loading amsi.dll, calling functions such as AmsiScanBuffer or AmsiOpenSession, or modifying related registry keys. This behavior is highly indicative of attempts to disable or bypass AMSI protection, a common step in executing malicious scripts or payloads on Windows systems.
Page 305 of 1168