Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,331 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the registration of new tools, plugins, or connectors into an AI agent's registry, particularly from unverified publishers or outside of sanctioned deployment windows. The rule also flags cases where these newly registered tools are immediately invoked with sensitive-scope permissions (e.g., admin, secrets, write), which is consistent with indicators of AI agent supply chain compromise or unauthorized tool injection.
Detects anomalous, high-volume HTTP requests to AI agent orchestration endpoints (e.g., tool invocation, plugins, or webhooks) followed by suspicious process execution or outbound network connections from the same host. This behavior is indicative of RCE exploitation against an AI agent framework, such as insecure deserialization or SSRF within a plugin connector.
Detects anomalous, high-volume file deletion, modification, or resource deletion operations performed by an identified AI agent service account within a short timeframe. This behavior is indicative of a compromised AI agent being leveraged for mass data destruction, ransomware activity, or disruptive configuration changes.
Detects node.exe processes initiating network connections to specific C2-related URI patterns commonly associated with ChainScript-style remote script loading. This behavior indicates an agent process retrieving attacker-supplied JavaScript code for execution via vm.runInNewContext, or establishing unauthorized C2 communication channels.
Detects unauthorized file deletion activity performed directly by a Node.js process acting as a ChainScript RAT. The RAT uses a bundled node.exe process, operating within specific masquerading directories in the user profile, to execute file system operations such as recursive deletion without spawning child processes.
Detects anomalous bursts of sts:GetCallerIdentity API calls, which are often used by adversaries to validate harvested or stolen AWS access keys. The rule monitors for a high frequency of such calls or a large number of distinct access keys being validated from IP addresses that are not part of the organization's approved corporate or cloud egress ranges.
Detects high-frequency access requests directed at authentication or API endpoints originating from known Tor exit-node IP addresses. This activity is indicative of credential stuffing or automated scanning patterns that attempt to evade IP-based reputation or rate-limiting filters.
Detects Salesforce Experience Cloud guest user sessions performing queries or reads on objects not within the authorized allowlist. This behavior, characterized by an abnormal volume of records retrieved or anomalous query patterns, is consistent with attempts to exploit misconfigured guest profile permissions to access internal sensitive data.
Detects instances where common scripting or development language runtimes (Go, Node.js, WScript, CScript) access sensitive configuration or credential files, such as AWS credentials, Kubernetes configs, SSH keys, or environment files. This activity is often indicative of credential harvesting or unauthorized access to sensitive secrets by potentially malicious scripts or processes.
Detects the registration of a new authentication method (e.g., FIDO2 key, authenticator app) shortly after a user account experiences a risky sign-in event. This pattern is indicative of an adversary attempting to establish persistent access and bypass MFA requirements, often following a successful AiTM (Adversary-in-the-Middle) phishing attack.
Page 58 of 1168