Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,542 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of a hidden file named '.git-checker' within system temporary directories (e.g., /tmp or \Temp\). This filename is often associated with adversary activity attempting to stage files, maintain persistence, or perform reconnaissance.
The detection rule monitors for access to files commonly used to store sensitive information, including .git-credentials, .netrc, and .gitconfig files configured to store credentials. Accessing these files is a common indicator of credential theft attempts by adversaries looking for plaintext authentication data to pivot to other systems or services.
Detects the creation of a file named 'DCRCVDrv.sys'. This filename is historically associated with malicious kernel-mode drivers used in cyberattacks, such as the DCRDRV exploit or related persistence/evasion mechanisms involving driver installation.
Detects the presence of specific debug log files ('nb_hook_dbg.txt', 'nb_sleep_dbg.txt', etc.) created within 'C:\WINDOWS\Temp\' by the PIVOTPIPE malware family. These artifacts are produced during the initialization of indirect syscall and sleep-mask evasion routines, serving as a proxy indicator for these stealthy execution techniques.
Detects the execution of known PIVOTPIPE beacon binaries by matching against specific file names and SHA256 hashes. These binaries are associated with post-exploitation activities and internal network pivoting.
Detects the execution of known PIVOTPIPE RAT binary files based on their SHA256 hashes or file names. PIVOTPIPE RAT is capable of token manipulation and impersonation techniques (e.g., ImpersonateLoggedOnUser, DuplicateTokenEx) to perform privileged operations or escalate security context.
Detects Node.js processes executing suspicious command lines that involve fetching and executing remote JavaScript code. This behavior is indicative of a loader or downloader script commonly used to pull and evaluate malicious payloads at runtime, specifically referencing indicators associated with 'GHAPPIER'.
Detects the Cursor IDE application launching specific macOS system binaries ('SystemUpdate', 'iSync', 'loginwindow') that are potentially being used to execute hidden backdoors, often associated with the 'FLATROOF' or 'ROOFDECK' threats. The rule looks for process spawning behavior where Cursor initiates these binaries with specific suspicious command-line flags ('nohup', '--type=renderer') or in directories associated with known malicious activity.
Detects instances where npm processes (install, preinstall, or postinstall) spawn suspicious child processes such as shell interpreters (cmd, powershell, bash, sh), network utilities (curl, wget), or scripting interpreters (python). This behavior is often associated with malicious npm package installation or software supply chain compromise where post-install scripts are used to gain persistence or download secondary payloads.
Detects network beaconing activity from suspicious processes that masquerade as macOS system services, specifically filtered to only trigger when an active Cursor IDE session is detected on the host. This behavior correlates network-based C2 activity with an active development environment, potentially indicating an adversary using legitimate IDE sessions to blend in or exfiltrate development-related data.
Page 307 of 1168