Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,582 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of a Windows scheduled task that attempts to execute a VMware-related binary (vmwared.exe) under the guise of 'MicrosoftEdgeUpdate' on system logon with the highest privileges. This behavior is indicative of a persistence mechanism attempt.
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
Detects usage of the WinRAR utility (rar.exe) with command-line arguments indicative of file archival, specifically using flags commonly associated with automated data collection or suspicious staging patterns such as password-protected archives (-hp) or specific file paths like 'web.rar' or those within VMware directories.
Detects anomalous process spawning where VS Code or Amazon Q language server processes (e.g., node, amazonq-lsp) execute shell utilities (e.g., bash, curl) with arguments related to .amazonq/mcp.json or specific credential/exfiltration commands. This behavior is associated with the exploitation of the MCP server auto-execution vulnerability (CVE-2026-12957).
Detects the execution of the Egnyte Host Monitor Client process based on a known file path pattern or a specific SHA256 file hash. This may be used to track the usage of Egnyte monitoring utilities in the environment.
Detects the loading of amsi.dll by processes running from suspicious or user-writable directories (e.g., Temp, AppData) or common scripting interpreters like Python. This behavior is often indicative of an attempt to tamper with or bypass the Antimalware Scan Interface (AMSI) for malicious purposes.
Detects the execution of known exploit binaries or the compilation of source files associated with the Linux PACKET_EDIT_MEME exploit (CVE-2026-46331). The rule monitors for specific binary names associated with the exploit, execution of these binaries from common staging directories (/tmp, /dev/shm, /run), and the use of GCC or CC compilers to build the exploit source files.
Detects unauthorized shells (bash, sh, dash, zsh) spawned as root from common setuid binaries (su, sudo, newgrp) by an unprivileged user. This behavior is indicative of the CVE-2026-46331 'pedit COW' vulnerability, where a local attacker performs page cache poisoning on a setuid binary to execute arbitrary code as root without disk modification.
Detects post-execution cleanup activities associated with Yuta/Glove stealer, including the deletion of files in PyInstaller temp directories (_MEI*), temporary paths, and the removal of specific stealer components (e.g., YutaCore.dll, SLaunch.exe) via command-line utilities like cmd.exe or PowerShell.
Detects Python interpreters (or processes executing from PyInstaller-generated temporary directories) accessing sensitive web browser files such as Login Data, Cookies, or Local State. This activity is commonly associated with information stealer malware, such as Glove Stealer, attempting to extract saved credentials from browsers.
Page 672 of 1168