Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a malicious Chrome extension exfiltrating keystrokes entered into the browser's Omnibox. The rule monitors for high-frequency GET requests (indicative of keystroke-by-keystroke transmission) from chrome.exe to a specific C2 domain (perplexity-ai.online), correlated with DNS resolution of that domain within the same session.
Detects instances where AI coding assistants (e.g., Claude Code, Cursor, Windsurf) spawn shell interpreters or scripting runtimes that subsequently initiate outbound network connections to non-private IP addresses. This behavior is indicative of potential malicious activity, such as credential theft or workspace trust bypass exploits (e.g., CVE-2026-12957), where an attacker leverages an AI coding assistant to execute arbitrary code. The rule excludes common build and test runner processes to minimize false positives.
Detects anomalous child process execution spawned by Lunar Client or associated Java runtime processes, typically stemming from a malicious Modrinth modpack. This exploit path leverages Electron framework vulnerabilities to execute arbitrary system binaries (e.g., cmd.exe, powershell.exe, explorer.exe) via shell commands triggered by modpack installation or execution.
Detects the creation of scheduled tasks using schtasks.exe or at.exe where the command line contains suspicious indicators such as execution from AppData/Temp directories, use of LOLBins (rundll32, regsvr32, powershell), encoded commands, or suspicious command-line patterns, specifically when the initiating process is not signed by Microsoft.
This rule detects the creation of suspicious scheduled tasks using either the schtasks command or through the system's scheduled task service. It focuses on task actions originating from suspicious parent processes (such as browsers or script interpreters), tasks executing scripts from writable user directories, or tasks with persistence triggers (e.g., /SC MINUTE, /SC ONLOGON) containing encoded PowerShell commands or hidden window styles indicative of malicious activity.
Detects malicious activities associated with The Gentlemen RaaS group, specifically targeting GPO modifications to distribute ransomware, disable Windows Defender Real-time Monitoring, and deploy persistence mechanisms via scheduled tasks in SYSVOL or NETLOGON paths.
This rule detects activities associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the loading of known vulnerable drivers, the installation or configuration of drivers via system services, and the execution of tools known to facilitate driver-based kernel manipulation.
Detects execution of processes by masqueraded lure executables associated with Mustang Panda campaign themes (e.g., India-Taiwan relations, hydropower projects) spawning known LOLBins like rundll32.exe, regsvr32.exe, or PowerShell, indicating potential side-loading or malicious loader activity.
Detects the spawning of a Python interpreter process by npm or node.js parent processes where the Python command line involves directories typically used for temporary files or staging (e.g., AppData, Temp). This behavior is consistent with the execution of the InvisibleFerret multi-stage backdoor, often delivered via malicious packages in developer environments.
Detects unauthorized processes (Node.js or Python) attempting to read sensitive browser credential files or access browser profile directories, often indicative of credential theft malware such as BeaverTail or InvisibleFerret.
Page 643 of 1168