Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Python interpreters launched by development tools (like VS Code or Node) that execute commands containing obfuscated code, base64-encoded strings, or strings indicative of credential harvesting and clipboard interaction, which may indicate malicious activity or post-exploitation behavior.
Detects potential Server-Side Template Injection (SSTI) attacks targeting the Flocci API Gateway using Velocity Template Language (VTL). The rule monitors for malicious VTL patterns in network traffic, subsequent OS command execution, anomalous file creation indicating RCE, and IAM scope bypass patterns in cloud environment logs.
Detects post-exploitation activity related to CVE-2026-55200 (libssh2 heap OOB write), specifically identifying when curl, git, or php processes spawn interactive shells or attempt to access sensitive processes like lsass.exe, indicating a successful exploit chain.
This rule detects PowerShell command lines that contain indicators associated with AMSI (Antimalware Scan Interface) bypass techniques and low-level memory manipulation methods, such as 'VirtualProtect' and 'GetFunctionPointer' used in conjunction with 'RuntimeHelpers'. These techniques are commonly used by attackers to subvert defensive security mechanisms and execute malicious code in memory.
Detects a suspicious process execution chain where explorer.exe or userinit.exe spawns cmd.exe, which in turn launches PowerShell to execute a hidden, bypassed, and obfuscated script involving content retrieval from the C:\ProgramData directory. This pattern is characteristic of the UAC-0226 GIFTEDCROOK actor's persistence mechanism using LNK files.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by executing PowerShell commands that manipulate memory structures directly. Specifically, it looks for the use of the Marshal.WriteInt64 method to nullify the pAppName pointer at offset 0x08 within the AMSI_CONTEXT_INTERNAL structure, a known technique to disable AMSI scanning for the current process.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by patching the AMSI context in memory. The rule identifies the combination of using VirtualProtect via P/Invoke to modify memory protections, followed by using Marshal.WriteInt64 to overwrite the pAppName field in the AmsiContext structure. This technique is commonly used by obfuscated PowerShell scripts to evade signature-based detection.
This rule detects attempts to disable the Antimalware Scan Interface (AMSI) in PowerShell by patching sensitive exported functions (AmsiScanBuffer, AmsiScanString, WinScanContent) within the process memory. Attackers use techniques like VirtualProtect and Marshal.Copy or JIT-compilation via RuntimeHelpers.PrepareMethod to overwrite these functions, effectively forcing AMSI to return an 'AMSI_RESULT_CLEAN' result for all scanned content.
Detects Claude or Node-based AI coding agents spawning child processes (e.g., bash, python) to execute commands commonly associated with repository setup, environment configuration, or potential malicious activity (e.g., base64 decoding, network connections, shell spawning). This is intended to identify indirect prompt injection where an AI agent is manipulated into executing unauthorized commands.
Detects instances where 'Mixed Reality.exe' or 'wmplayer.exe' load DLLs from suspicious directories such as AppData, Temp, or ProgramData, specifically when the loading process or the loaded DLL appears unsigned or lacks verification by Microsoft. This behavior is indicative of potential DLL sideloading or hijacking, where adversaries leverage trusted applications to execute malicious code.
Page 617 of 1168