Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,335 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects instances where the WMI Provider Host process (wmiprvse.exe) initiates a child process. While WMI is a legitimate administrative tool, it is frequently abused by attackers for lateral movement, remote code execution, and persistent event subscriptions. Monitoring for child processes spawned by wmiprvse.exe can highlight potentially malicious activity triggered via WMI.
This rule detects persistence mechanisms involving the creation or modification of Windows Registry Run keys, the creation of scheduled tasks, or the execution of specific binaries (COTFileReadApp.exe, DeElevate64.exe) associated with potentially unauthorized activity, specifically tracking strings related to 'Canon Configuration Reader' or 'Stardock DeElevation Tool'.
Detects instances where a process loads both amsi.dll and the .NET CLR (clr.dll or mscoree.dll) within a 60-second window, excluding known legitimate .NET and PowerShell hosts. This behavior is indicative of an in-memory shellcode loader attempting to bypass AMSI protections before executing .NET payloads in memory, a technique frequently observed in sophisticated malware campaigns.
This rule detects suspicious PowerShell command-line activity that uses '-ExecutionPolicy Bypass' in conjunction with network-fetching cmdlets like 'Invoke-RestMethod' or 'irm' to download files to a temporary directory, followed by potential script execution. This pattern is commonly used by adversaries for stage-1 payload delivery and fileless execution.
Detects files, such as container image layers or extracted binaries, that contain a combination of CARBONATO botnet registry infrastructure artifacts and cryptocurrency wallet application strings. This indicates the presence of a trojanized wallet application originating from the CARBONATO operators' unauthenticated registry infrastructure.
Detects the CARBONATO botnet's XMRig cryptocurrency miner attempting to hide its presence on Linux hosts by masquerading as the systemd-logind binary or by spoofing kernel thread names such as [kworker/u2:0] in process command-line arguments.
Detects HTTP traffic originating from internal hosts to external destinations on port 8989, specifically targeting '/chat/completions' URI patterns. This activity is indicative of the CARBONATO/Hermes Agent leveraging LLM gateway infrastructure as a command-and-control (C2) channel.
Detects the CARBONATO GH0ST Hermes Agent activity of harvesting and storing AI API keys (such as OpenAI, Anthropic, Google Gemini, etc.) as plaintext files within the /root/.hermes/loot/ directory. This is consistent with the agent's behavior of staging credentials for later exfiltration.
Detects persistence mechanisms associated with the CARBONATO botnet. The rule identifies two primary behaviors: the execution of a hidden watchdog binary '/usr/local/bin/.docker-network-monitor' by the cron daemon, and the use of 'chattr +i' to make this watchdog binary immutable, preventing deletion or modification.
This rule detects a multi-tool attack chain involving the Cairn autonomous exploitation engine and the Hermes Agent. It flags the co-occurrence of outbound network traffic to both the DeepSeek API (Cairn engine) and the Anthropic Claude API (Hermes Agent) from the same host within a one-hour window. This behavior is indicative of an automated, AI-driven post-exploitation orchestration campaign.
Page 64 of 1168