Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,556 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where AI-assisted coding tools or command-line interfaces spawn scripting runtimes (Node.js, Python) to access sensitive files such as SSH keys, cloud provider credentials, or Kubernetes configurations. This behavior may indicate an AI coding assistant being coerced or misconfigured to exfiltrate secrets from the development environment.
Detects instances where PowerShell attempts to inject code into legitimate processes (such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe) using direct syscalls NtAllocateVirtualMemoryRemote or NtSetContextThreadRemote, indicating potential process injection activity.
This rule monitors for any process execution event captured by the EDR solution. It serves as a catch-all for recording process creation telemetry.
Detects anomalous sign-in patterns from a single IP address that target multiple accounts with a high success rate within a short timeframe. This behavior is indicative of targeted credential guessing or password spraying informed by reconnaissance, as it deviates from the typical low-success-rate patterns of broad brute-force attacks.
Detects outbound network requests to popular Large Language Model (LLM) API endpoints originating from processes that do not appear to be standard web browsers or identified legitimate development tools. This behavior may indicate an unauthorized script, malware, or compromised process attempting to use LLM APIs for C2, data exfiltration, or automated reconnaissance.
This rule detects potential CI/CD security compromises in GitHub by monitoring for modifications to workflow permissions that grant 'write-all' access, access to sensitive workflow secrets via 'pull_request_target' from forked repositories, and the registration of new self-hosted runners. These actions are common indicators of supply chain attacks aimed at poisoning pipeline execution or exfiltrating build secrets.
Detects high-value wire transfer approvals within payment and ERP systems that exhibit indicators of business process compromise, specifically those bypassing standard dual-authorization controls in the immediate aftermath of an out-of-band verification event, suggesting potential deepfake or social engineering impersonation attacks.
Detects business email compromise (BEC) lures by identifying a discrepancy between the 'From' address and the 'Reply-To' address in conjunction with high-urgency keywords related to financial transactions. This logic is intended to catch AI-crafted phishing emails that bypass traditional signature-based filters but rely on structural artifacts like Reply-To misdirection.
Detects attempts to perform prompt injection against internal Large Language Model (LLM) inference APIs. The rule monitors HTTP proxy logs for specific query parameters designed to trick the model into disclosing its underlying system instructions or hidden prompts.
Detects high-risk destructive database operations (DROP, TRUNCATE, or mass DELETE without a WHERE clause) performed by automated identities (AI agents, service accounts, or automation scripts) in a production environment outside of an authorized change window. This rule is designed to identify potential excessive-agency incidents where automated systems perform unauthorized destructive actions.
Page 436 of 1168