Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,573 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the injection of code into an svchost.exe process from a non-system directory, followed by the loading of .NET CLR runtime modules (clr.dll, clrjit.dll, or mscorlib.ni.dll) within 5 minutes. This pattern often indicates an attempt to execute managed code inside a legitimate system process, potentially to evade security controls. The rule further enriches the finding by identifying if the svchost.exe process is running in a non-standard service group, which serves as a high-confidence signal of anomalous behavior.
Detects a suspicious execution chain associated with LegionLoader where msiexec.exe triggers cmd.exe, which subsequently invokes 7-Zip (7z.exe or 7za.exe) to extract payloads into the AppData\Roaming directory. This pattern is characteristic of LegionLoader's staging phase.
Detects the creation of Windows scheduled tasks using 'schtasks.exe' where the executable being registered or the task itself is associated with suspicious directories like %LOCALAPPDATA%, %APPDATA%, or %TEMP%. The rule further filters for specific suspicious strings often used in malicious task configurations, indicating potential persistence or malicious command execution.
Detects the AWS CLI being spawned by processes associated with AI coding extensions (e.g., VS Code extension hosts, Cursor, Windsurf) while executing commands indicative of cloud credential discovery or harvesting (e.g., sts, get-caller-identity, configure export). This activity is indicative of a supply chain compromise or exploitation where an adversary leverages an AI coding tool environment to access cloud credentials stored on the developer's workstation.
Detects unauthorized execution of AWS CLI commands within a shell spawned by Amazon Q or AWS language server processes. This activity typically involves the 'aws sts get-caller-identity' command being piped to 'curl' for remote exfiltration of cloud credentials, a behavior associated with the exploitation of CVE-2026-12957 in MCP auto-execution.
Detects anomalous outbound network traffic from Firefox processes indicative of CVE-2025-15661 exploitation. The rule monitors for communication with a specific non-standard port (8765) associated with a SmartWindow PoC server, or requests containing suspicious URI query parameters ('u0', 'u1', 'u2', 'source=history') frequently used for exfiltrating private browsing tabs and history via the '/leak' endpoint.
Detects evidence of arbitrary command execution originating from OpenVPN Connect, potentially via an echoed script payload that executes commands upon disconnect, bypassing security controls. The rule identifies suspicious child processes spawned by OpenVPNConnect.exe and detects the creation of a known proof-of-concept marker file.
Detects artifacts, execution patterns, and post-exploitation behaviors associated with the exploitation of the libssh2 heap out-of-bounds write vulnerability (CVE-2026-55200). The rule monitors for the presence of known proof-of-concept files, malicious SSH server orchestration via Python, outbound network traffic to the PoC's default non-standard port (2222) from SSH-capable applications, and post-exploitation shell or calculator spawns.
Detects the loading of known vulnerable drivers (e.g., ProcessMonitorDriver.sys, inpoutx64.sys) associated with 'The Gentlemen' RaaS group, used in BYOVD attacks to elevate privileges and terminate security products.
This rule detects network connections from internal hosts to a list of known malicious IP addresses associated with the Payroll Pirate campaign (attributed to Storm-2755 and Storm-2657). Identifying these connections indicates potential communication with adversary-controlled infrastructure.
Page 598 of 1168