Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,575 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potentially malicious use of the Windows Package Manager (WinGet) to configure system environments, specifically targeting flags that bypass user interactivity or agreements, as well as the spawning of the ConfigurationRemotingServer by WinGet or related package management processes, which could indicate the deployment of unauthorized or malicious configurations.
This rule detects potential exfiltration attempts from a GCP Cloud Run container by monitoring for outbound network connections triggered by processes reading sensitive local files. The files being monitored include environment variable configurations (/proc/self/environ) and application source code, which may contain credentials or service account tokens.
Detects AI coding extensions (e.g., Cursor, Windsurf, Claude) spawning Node.js or Python child processes to execute potential Model Context Protocol (MCP) server configurations located in non-standard, potentially untrusted workspace paths. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-12957, where adversaries leverage MCP to gain unauthorized command execution.
Detects Lunar Client spawning suspicious child processes or command lines, which is characteristic of exploit chains like 'lunar-modrinth-chain-poc'. These attacks typically leverage renderer vulnerabilities to execute shell commands, .lnk files, or arbitrary binaries via abused APIs like shell.openExternal or malicious modpack overrides.
Detects anomalous child process creation, suspicious command-line arguments, or the presence of specific file artifacts associated with the exploitation of heap corruption vulnerabilities in FFmpeg RASC/DLTA codecs (as demonstrated by the exploitarium FFmpeg-RASC-DLTA-calc-poc PoC).
Detects unauthorized or malicious shell command execution spawned by the Amazon Q Developer VS Code extension, originating from a workspace-defined MCP (Model Context Protocol) server configuration file (.amazonq/mcp.json or .vscode/mcp.json) as associated with the CVE-2026-12957 vulnerability.
Detects the use of the Tiny C Compiler (tcc.exe) with command-line arguments to compile and execute shellcode from a 'config.ini.c' file located in the %LOCALAPPDATA%\TCC directory. This technique is specifically associated with BeepRAT to execute code directly in memory while attempting to evade security controls like AMSI, ETW, and WLDP.
Detects suspicious child processes spawned by AI-powered IDE assistants (e.g., Amazon Q, Claude Code, Cursor) that perform AWS credential inspection combined with network exfiltration commands. This activity is indicative of exploitation of IDE extension vulnerabilities (e.g., CVE-2026-12957) where malicious configuration files force the IDE to spawn shell processes to steal and transmit cloud environment credentials.
Detects the presence of file system artifacts associated with a malicious Chrome extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a 'Perplexity AI' search tool. This extension is known to hijack browser search queries by redirecting them through the typosquatted domain 'perplexity-ai.online'.
Detects the presence of the malicious Chromium extension 'Search for perplexity ai' (ID flkebkiofojicogddingbdmcmkpbplcd) on disk. This extension hijacks browser default search settings to redirect queries through the typosquatted domain perplexity-ai[.]online.
Page 614 of 1168