Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,551 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of git checkout commands initiated by known AI-powered coding assistants or CLI tools. This behavior may indicate an AI agent or automated script interacting with source code repositories in an unexpected or potentially unauthorized manner.
This rule detects potentially suspicious Git checkout operations initiated by AI coding assistant processes (such as Copilot, Claude, or Gemini). It looks for cases where these assistants execute a 'git checkout' command containing a specific commit hash (40 characters), followed by a secondary event where the git output indicates an 'ambiguous refname' error. This pattern may suggest an attempt by an AI tool to manipulate repository state or checkout arbitrary objects, potentially related to unauthorized code injection or malicious repository interaction.
Detects command-line activity indicating an attempt to bypass or tamper with Anti-Malware Scan Interface (AMSI) functionality. The rule flags processes invoking GetProcAddress or LoadLibrary to resolve and manipulate AMSI-specific functions like AmsiScanBuffer or AmsiScanString within amsi.dll, a common technique for disabling runtime script scanning.
Detects the execution of wscript.exe with silent (/B) and no-logo (/Nologo) flags, spawned by a process named MicrosoftEdgeUpdateTaskCore. This pattern is indicative of potential living-off-the-land techniques where an adversary leverages a legitimate system task to execute scripts stealthily.
Detects outbound network connections from internal hosts to known Autonomous System Numbers (ASNs) associated with SilkParasite infrastructure, which are often used to host malicious command-and-control or staging assets.
Detects unauthorized processes attempting to access sensitive browser files, including Login Data (passwords) and Network/Cookies databases for Chrome, Edge, and Firefox. These files are primary targets for credential dumping and session hijacking.
Detects execution of PowerShell spawned by wscript.exe or cscript.exe attempting to retrieve a process-level environment variable named 'Kv[0-9]+'. This pattern is associated with 'LausivLoader', which uses environment variables to pass file paths or malicious payloads between a legacy script host and PowerShell. The rule optionally tracks attempts to delete associated files after the handoff.
Detects the spawning of a hidden PowerShell process by wscript.exe via conhost.exe with the --headless argument. This pattern is characteristic of the LausivLoader malware, which utilizes obfuscated command-line arguments to execute hidden PowerShell scripts.
Detects the use of .NET reflection methods such as Assembly.Load or EntryPoint.Invoke within PowerShell command lines. This behavior is frequently used by attackers to reflectively load malicious .NET assemblies or shellcode directly into process memory, bypassing disk-based detection.
Detects execution of PowerShell commands containing indicators of in-memory AMSI (Antimalware Scan Interface) patching, specifically referencing AmsiScanBuffer, AmsiScanString, or AmsiOpenSession in conjunction with amsi.dll. This behavior is associated with the initialization stage of LausivLoader prior to its payload retrieval phase.
Page 379 of 1168