Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,591 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Three related Linux kernel local privilege escalation vulnerabilities disclosed between April and May 2026, CopyFail (CVE-2026-31431), DirtyFrag (CVE-2026-43284 / CVE-2026-43500), and Fragnesia (CVE-2026-46300) all share the same core exploitation primitive — an unprivileged local user abuses an in-kernel in-place decryption path (via AF_ALG authencesn, xfrm-ESP, or ESP-in-TCP respectively) combined with repeated splice() syscalls to corrupt the page cache of a setuid binary such as /usr/bin/su, then executes it to obtain a root shell without any authentication; all three have public proof-of-concept code, affect Linux kernels from 4.14 onward, and can be mitigated by blacklisting the esp4, esp6, rxrpc, and algif_aead kernel modules until patched kernels are deployed.
Detects unauthorized processes attempting to access sensitive browser credential stores, such as Login Data, Cookies, or Local State, typically targeted by the Millenium RAT (DotStealer component) to harvest credentials and bypass Chromium App-Bound encryption.
Detects DcRAT malware attempting to perform fileless process injection into svchost.exe from the 'Mixed Reality.exe' process. This behavior leverages NT API calls such as ZwWriteVirtualMemory and NtDuplicateObject, a technique identified in Operation DragonReturn targeting Indian infrastructure.
Detects the creation, deletion, or starting of a Windows service named 'MixedSvc' via sc.exe. This activity is associated with the 'Operation DragonReturn' campaign, where adversaries leverage a service masquerading as legitimate Windows Media Player components to maintain persistence.
Detects Millenium RAT payloads that masquerade as legitimate Windows processes (such as MsEdgeUpdate or svchost.exe) by running from temporary directories (AppData or Temp). The rule also monitors for associated persistence mechanisms via HKCU Run registry keys.
Detects a specific AMSI bypass technique associated with Operation DragonReturn, where the process patches amsi.dll memory using VirtualProtect after dynamically locating the function with GetModuleHandleA and GetProcAddress.
Detects unauthorized persistence established by the TONResolver RAT, where the node.exe process creates or modifies an autorun registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The registry value points to an executable located within the user's AppData\Local\Nodejs directory, a common path utilized by the malware for persistence.
Detects Millenium RAT (or similar malware associated with the Y2K Operators campaign) writing keystroke capture files to user APPDATA directories. The rule specifically monitors file creation events by non-browser/non-UI processes that utilize suspicious file extensions (.g0, .txt, .log, .dat).
Detects anomalous network traffic from svchost.exe processes exhibiting suspicious behavior indicative of DcRAT, specifically reconnaissance activities that involve gathering system information and security product details for exfiltration to a Command and Control (C2) server.
Detects phishing emails associated with the TONResolver campaign that impersonate Booking.com guest complaints. The rule identifies suspicious emails containing .ics calendar file attachments or links to domains matching the pattern 'photo-[0-9]+.cfd', primarily targeting hospitality staff with subject lines related to hotel inquiries or issues.
Page 747 of 1168