Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to execute arbitrary JavaScript code on a MongoDB server using the deprecated eval command or patterns consistent with sandbox escape techniques (probing for process, load, and require functions).
Detects attempts to bypass the Redis Lua scripting environment sandbox by injecting 'require' and 'dofile' commands within an 'EVAL' request. These commands are typically used to load external modules or files, which, if successful, could allow an attacker to achieve arbitrary code execution on the server hosting the Redis instance.
Detects unauthorized attempts to access the Marimo Notebook terminal via a WebSocket connection, indicative of an exploit attempt targeting CVE-2026-39987.
Detects the deployment and activity of SilkParasite-associated Linux threats, including XMRig cryptocurrency miner shell scripts and standalone Meterpreter agents. The rule also captures the execution of a custom Python fleet-scanning tool used to interact with exposed Redis instances for unauthorized command execution and infrastructure management.
Detects 'GetSecretValue' API calls to AWS Secrets Manager originating from programmatic agents like Boto3, Python requests, or the AWS CLI. This monitors for automated retrieval of stored secrets, which may indicate unauthorized credential access or exfiltration from an AWS environment.
Detects the creation of persistence mechanisms on Linux systems using APT Pre/Post-Invoke hooks (e.g., /etc/apt/apt.conf.d/99sys-update) or user profile initialization scripts (e.g., /etc/profile.d/sys-init.sh). The rule monitors for these files containing suspicious command strings such as curl downloads, xmrig mining configurations, or specific init-hook markers often used by cryptomining botnets.
Detects the presence of XMRig cryptocurrency miner ELF binaries by scanning for unique structural strings and configuration flags indicative of XMRig operations. This rule uses YARA to inspect binary file contents, enabling detection of miners regardless of their on-disk filename or obfuscation techniques such as hiding them within dotfiles.
Detects HTTP GET requests characteristic of SilverFox malware final-stage payload delivery. The rule monitors for requests to known C2 domains or domains using a specific naming pattern (www.[5-10 chars].com) with specific URI paths (down, load, or insdw followed by 2-4 digits), indicating the retrieval of a malicious payload.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with the SilverFox relay and dispatch infrastructure. These indicators are commonly used by the SilverFox malware for command and control (C2) communications.
Detects DNS queries and HTTP Host header traffic to known SilverFox malware impersonation domains. These domains utilize .com.cn TLDs and typosquatting techniques to masquerade as legitimate software or service providers.
Page 399 of 1168