Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,586 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects malicious execution patterns during npm package installation consistent with Miasma and Mini Shai-Hulud supply chain attacks. The rule monitors for node.exe or bun.exe being spawned by npm or node-gyp that exhibit suspicious behavior, such as accessing sensitive credential paths (e.g., .ssh, .npmrc, .gitconfig) or utilizing a Phantom Gyp execution pattern where index.js is executed directly within node_modules via node-gyp, as well as bun.exe staging execution from temporary directories.
Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.
Detects unauthorized writes to the /proc/sys/vm/drop_caches interface by non-root users or processes that are not standard system maintenance tools. This activity is a known post-exploitation technique used by exploits like the 'pedit' COW exploit to clear cached setuid binary pages in memory for evasion or cleanup.
Detects the Miasma malware attempting to enumerate installed developer and AI coding tools by executing version-check or help commands. The rule monitors for a pattern of 5 or more child process executions from 'node.exe' or 'bun.exe' within a 30-second window, which targets tools like VS Code, Cursor, Claude, AWS CLI, kubectl, helm, npm, git, and docker.
Detects unauthorized HTTPS POST requests to sensitive GitHub API endpoints (gists, repository contents, user emails) originating from standard command-line tools like curl, node, and PowerShell. Additionally, it identifies suspicious git push operations initiated from within node-based installation scripts, which is indicative of credential harvesting and exfiltration behaviors exhibited by the Miasma worm.
Detects the self-deletion mechanism used by the TinyRCT backdoor, which employs a timed delay loop using either 'choice.exe' or 'ping.exe' before executing a file deletion command ('del' or 'erase') to remove its own executable from the system. This behavior is indicative of a malware cleanup routine designed to erase traces of its presence after activity has concluded.
Detects the use of WinRAR or rar.exe to archive sensitive web directory content (e.g., wwwroot, web.config, database files) when spawned from web server processes like w3wp.exe or cmd.exe. This behavior is indicative of data staging for exfiltration, a common tactic for actors like those associated with the CL-STA-1062 intrusion campaign.
This rule detects the execution of script files (.vbs, .ps1, .hta, .lnk, .exe) from potential removable media drives (drive letters D-Z) by common Windows interpreters (wscript.exe, cscript.exe, powershell.exe). It monitors for these processes being launched either as standalone processes or as children of other scripts, explorer.exe, or interpreters, while explicitly excluding paths typically associated with legitimate Windows system and program directories.
Detects suspicious execution of kernel-related networking commands ('unshare', 'ip', 'modprobe', 'insmod') by non-root users that are associated with the setup or exploitation phases of the 'DirtyClone' Linux kernel privilege escalation exploit. The rule specifically looks for IPsec tunnel/policy manipulation or the loading of ESP/RxRPC kernel modules by unprivileged accounts.
This rule detects the creation of directories or files within the '\Temp\' directory that match a specific naming pattern ('RP_' followed by an alphanumeric string). This pattern is often associated with the creation of temporary artifacts by scripts, installers, or malicious payloads.
Page 719 of 1168