Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,582 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the BeepRAT malware establishing persistence by creating a scheduled task named 'WindowsUpdateTempFileCleanUp' via 'schtasks.exe'. The task is configured to execute a malicious loader chain using the Tiny C Compiler to run a hidden config file, often spawned from a binary named 'HFY.exe'.
Detects the presence of the malicious Chrome extension with ID 'flkebkiofojicogddingbdmcmkpbplcd' on an endpoint. This extension is known to hijack the browser's default search provider, redirecting queries to an attacker-controlled domain, and includes manifest configurations that may facilitate future WebAssembly-based malicious execution.
Detects network requests to a typosquatted domain 'perplexity-ai.online' initiated by a malicious browser extension. The extension uses the 'suggest_url' feature to exfiltrate keystrokes typed into the browser omnibox in real-time, effectively performing browser-based keylogging.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
Detects suspicious child process activity originating from common IDEs or AI language server processes that indicates AWS credential exfiltration. The rule monitors for command-line patterns indicative of credential dumping or exfiltration, such as the use of AWS CLI commands, curl, or npx with the Model Context Protocol (MCP) in conjunction with attempts to access sensitive environment variables or redirect output.
Detects the Ghidra reverse engineering suite spawning suspicious child processes such as command shells, scripting interpreters, or network utilities. This activity often indicates an attempt to automate reverse engineering tasks or interact with the system in an unintended manner by potentially malicious scripts or plugins.
Detects suspicious activities originating from SimpleHelp remote support processes, including the spawning of unauthorized child processes, execution of potentially malicious JavaScript loaders (e.g., TaskWeaver-related), and access to sensitive browser-based credential or configuration files often targeted by infostealers like Djinn Stealer.
Detects potential Velocity Template Language (VTL) injection attacks targeting API Gateway environments. The rule identifies suspicious payloads in HTTP request bodies or URLs that attempt to leverage Java-based classes (e.g., ProcessBuilder) for code execution. It also monitors for IAM scope bypass attempts, abnormal HTTP method/path combinations associated with API Gateway control-plane operations, and evidence of shell/system commands being spawned from API Gateway-related parent processes.
Detects anomalous or unauthorized processes accessing sensitive AI configuration files, SSH configurations, version control files, and shell history within a short time window. The rule flags instances where non-standard or unexpected applications exhibit broad or high-frequency access to these files, which are common targets for credential harvesting or exfiltration by adversaries.
Detects anomalous activities associated with the SystemInformer (formerly Process Hacker) kernel driver service (phsvc), which is known to be leveraged for local privilege escalation (LPE). The rule identifies the execution of rundll32 with suspicious command line parameters, the spawning of SYSTEM-level child processes by the phsvc service context, and unauthorized access to the SiSvcApiPort named pipe, which is used for inter-process communication with the kernel driver.
Page 668 of 1168