Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,576 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects HTTP/1.1 requests containing an Upgrade header (specifically targeting WebSocket upgrades) accompanied by a non-zero Content-Length header. This pattern is characteristic of a request smuggling primitive targeting the nghttpx reverse proxy, where the provided body may be misinterpreted by the backend as a separate, smuggled request due to improper request queue handling.
This rule detects 'git clone' operations on Windows systems that are correlated with the creation of or access to specific Amazon Q or VSCode Model Context Protocol (MCP) configuration files ('mcp.json'). The rule identifies potential unauthorized project cloning or reconnaissance activity involving developer tools.
Detects unauthorized processes (non-browser related) attempting to modify Chrome/Chromium user profile preference files or sensitive browser registry keys related to search providers and security MACs. This activity is often associated with browser hijacking, malware persistence, or unauthorized manipulation of browser settings.
This rule detects processes running from non-standard locations (specifically within application data directories) that perform both file system write operations for media or image formats (indicative of screen, audio, or video capture) and simultaneously initiate outbound network connections to non-private IP addresses. This behavior is often characteristic of spyware, unauthorized remote access tools, or malware attempting to capture and exfiltrate user activity.
Detects the execution of multiple system discovery utilities (systeminfo, wmic, ipconfig, net, arp, tasklist) originating from non-standard or suspicious directories (such as temp, appdata, or user directories). This behavior is often indicative of an adversary performing automated reconnaissance or discovery after gaining initial access.
Detects the execution of wmic.exe with command-line arguments related to hardware enumeration (e.g., system, BIOS, memory, video controller information) which are commonly used by malware for sandbox evasion and VM fingerprinting. The rule specifically alerts when these commands are spawned by processes running from suspicious temporary directories or staging paths often associated with malware droppers.
Detects a suspicious sequence of events involving the creation of an .amazonq/mcp.json file shortly after a git clone operation, followed by an AI coding assistant (Amazon Q, VS Code, Cursor, Windsurf) spawning runtime interpreters (node, npx, python). This behavior aligns with potential exploitation attempts against AI-assisted development environments, such as CVE-2026-12957, where malicious configuration files are used to trigger unauthorized code execution.
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
Detects suspicious activities originating from OpenVPN Connect processes, including the spawning of command-line interfaces, scripts, or proxies, as well as the creation of specific ACE marker files and modifications to browser proxy settings, which are indicative of potential exploitation or post-exploitation activity.
This rule detects potential TaskWeaver malware loader activity by monitoring for suspicious process execution patterns within a SimpleHelp Remote Monitoring and Management (RMM) context. Specifically, it triggers when a SimpleHelp process launches common scripting interpreters (wscript.exe, cscript.exe, node.exe, powershell.exe, cmd.exe) or when a file named 'jquery.js', a known lure filename used by TaskWeaver, is executed.
Page 624 of 1168