Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,575 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of .amazonq/mcp.json or mcp.json files within repository directories following a git clone operation. This behavior is associated with the exploitation of vulnerabilities (such as CVE-2026-12957) where attackers use malicious job-interview repositories to trigger automatic execution of arbitrary MCP (Model Context Protocol) servers in the Amazon Q Developer extension in VS Code, potentially leading to unauthorized credential or sensitive data access.
This rule monitors for file system activity associated with the 'libpwn' exploit suite, specifically targeting files related to the exploitation of CVE-2026-55200. It flags the presence of exploit harnesses, probes, and proofs of concept (PoCs) identified by specific filenames and directory structures.
Detects the AnyDesk service-side printer worker process spawning suspicious child processes (e.g., cmd.exe, powershell.exe). This activity is indicative of exploitation attempts against CVE-2026-43503, where an attacker leverages the 'adprinterpipe' named pipe to send malicious COM marshaling bytes and impersonate the LocalSystem identity to escalate privileges.
Detects incoming phishing emails sent from personal Gmail accounts that attempt to impersonate law firms by using legal-themed subjects (e.g., lawsuits, subpoenas, cease and desist). The rule specifically identifies the use of URL shorteners commonly used to obfuscate credential-harvesting destinations. The detection relies on email metadata and subject line patterns to identify potential spearphishing attempts.
Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.
Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.
Detects execution of Node.js processes associated with the TaskWeaver JavaScript loader. The rule monitors for unauthorized Node.js processes (lacking official publisher signatures) spawning secondary processes or executing specific suspicious command lines linked to TaskWeaver and Djinn Stealer activity, such as loading obfuscated jquery.js or accessing configuration files associated with credential theft.
Detects the creation of large extensionless files in the C:\ProgramData directory by common archive extractors or script interpreters. This pattern is characteristic of UAC-0226/GIFTEDCROOK payload staging, where malicious loaders or encoded PE artifacts are dropped to disk for subsequent execution or decoding.
Detects the use of .NET reflection within PowerShell to resolve and invoke native Windows APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx) typically used by the GIFTEDCROOK actor to perform in-memory shellcode or PE loading. The rule searches for command line patterns combining native API names with reflection-related keywords.
This rule detects non-Mozilla processes that systematically access sensitive Firefox browser files such as logins.json, key3.db, key4.db, and cookies.sqlite. Repeated access by processes not associated with the Mozilla Corporation or the Firefox browser suite is indicative of credential harvesting attempts by malicious software.
Page 625 of 1168