Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,586 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects when a command-line shell (bash, sh, cmd, powershell) is spawned by a parent process (curl, git, php, ssh) that has recently established an outbound network connection on port 22 (SSH). It also flags instances where the child shell process subsequently opens a network listener, often indicating a potential reverse shell or unauthorized remote access attempt.
Detects rapid enumeration of system binaries related to SSH and networking libraries (libssh2, libcurl, libgit) or version checks within a 5-minute window, which may indicate reconnaissance or pre-exploitation activity related to vulnerabilities like CVE-2026-55200.
Detects the Flowise application launching a Node.js child process with a --require flag, which indicates an attempt to exploit an environment variable case-sensitivity bypass (e.g., node_options vs NODE_OPTIONS) in the MCP environment to preload malicious JavaScript code.
Detects the exploitation of CVE-2026-20896 in Gitea, where an unauthenticated attacker sends a crafted POST request to user registration or installation endpoints. The rule triggers when this network activity is followed by the creation of a new user account with administrative roles within a 10-minute window, indicating potential privilege escalation.
Detects suspicious PowerShell processes executing common system reconnaissance commands (e.g., whoami, net group, ipconfig) combined with network communication indicators, specifically HTTP method or body flags, or connections to known suspicious IP addresses.
This rule detects potential data staging activities by monitoring for specific file paths and filenames associated with unauthorized collection of sensitive data (such as VPN configs, password databases, and office documents). It triggers when processes not typically associated with these file types access or interact with sensitive directories and file extensions.
Detects instances where processes associated with Claude AI (e.g., node, shell) spawn suspicious child processes such as Python interpreters, pip package managers, or shell scripts (sh, bash) with command-line arguments indicative of AI-driven project initiation, package installation, or automated setup tasks. This pattern is characteristic of AI-based agents executing code or performing automation on a developer workstation.
Detects suspicious command execution patterns, including reverse shell techniques (/dev/tcp, bash -i), DNS-based C2 communication (axiom-config, m100.cloud), and fileless payload retrieval (dig TXT queries). It specifically highlights commands initiated by common AI developer tools or runtimes (claude, node, python) that correlate with known adversarial setup scripts or potential prompt injection outcomes.
This rule detects potentially suspicious process executions originating from the Amazon Q language server or related processes. It monitors for commands involving MCP configuration files, AWS STS identity verification, and generic HTTP POST requests, which may indicate unauthorized activity or credential/configuration harvesting.
Detects in-process memory manipulation of amsi.dll (AmsiScanBuffer/AmsiScanString) within PowerShell script block logs (Event ID 4104). This activity often involves using VirtualProtect or Marshal.Copy to apply an in-memory patch (e.g., return-early 0xC3) to neutralize AMSI scanning capabilities, which is a common technique for bypassing defensive security controls.
Page 717 of 1168