Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,540 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where a Semantic Kernel AI agent, running via Python or .NET, accesses sensitive local files like SSH keys, cloud credentials, or environment files immediately before triggering a potential file upload operation.
Detects instances where an AI agent (e.g., Semantic Kernel) launches command-line tools commonly used to perform bulk data destruction or system wiping, such as file deletion commands, volume shadow copy removal, or disk formatting. This rule flags suspicious orchestration by AI agents that may be acting outside of expected parameters.
Detects attempts to bypass input sanitization in AI agent frameworks, specifically Semantic Kernel, by using Python bracket or subscript notation to access sensitive attributes or functions (e.g., __class__, __subclasses__, __import__, eval, exec). This technique is characteristic of filter injection attacks aiming to achieve remote code execution in AI agent environments.
Detects instances where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command-line utility or scripting engine (e.g., PowerShell, WScript, Cmd) to execute a file located within common download or temporary directories. This behavior is a common indicator of a user executing a malicious file downloaded from the internet.
Detects the creation or modification of documents in common formats (e.g., .txt, .md, .docx, .pdf) that contain strings indicative of prompt-injection attempts. These strings are commonly used to manipulate the behavior of AI agents or Large Language Models (LLMs) that may process or index these files automatically.
Detects high-frequency authentication failures (Event ID 4625) originating from a single IP address against multiple different user accounts, indicating potential automated brute force or credential spraying activity.
Detects the creation of executable or script files (.py, .js, .mjs, .sh, .ps1) within hidden configuration directories associated with AI coding assistants and development tools (e.g., .claude, .vscode, .cursor). This activity may indicate an attempt to hijack development environments by dropping malicious scripts into locations that tools or developers might inadvertently execute or trust.
Detects repeated TLS connections to a known suspicious IP address that masquerades as gitlab.com using the TLS Server Name Indication (SNI) extension. This pattern is indicative of potential command and control (C2) traffic from compromised or unauthorized GitRunner infrastructure.
Detects network traffic associated with NarwhalRAT malware utilizing the pCloud API as a command-and-control (C2) channel or dead-drop resolver. The rule monitors both HTTP requests containing specific folder identifiers and authentication parameters, as well as TLS SNI indicating connections to api.pcloud.com.
Detects instances where a GitLab Runner process (gitlab-runner-windows-amd64.exe) spawns PowerShell with flags commonly associated with bypassing execution policies and executing non-interactive commands. This behavior may indicate an attacker using a CI/CD runner as an entry point for lateral movement or command-and-control.
Page 310 of 1168