Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,592 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of 'aws sts get-caller-identity' from unexpected or potentially suspicious parent processes such as Node.js, bash/sh, or IDE-related processes like VS Code or Amazon Q. This command is often used by developers to confirm identity, but when triggered from these contexts, it may indicate unauthorized access or exploration by an adversary operating within a development environment.
Detects potentially unauthorized or suspicious child process execution originating from IDEs associated with Amazon Q/CodeWhisperer. The rule monitors for common shell execution (bash, sh, node) or AWS-related command-line activity that may indicate credential harvesting or exfiltration via IDE extensions.
Detects suspicious behavior linked to the BeepRAT malware or related tooling (tcc.exe, LuaJit.exe). It monitors for the loading of GDI32 modules by these specific processes and identifies instances where these processes perform cross-process access to sensitive Windows system processes like explorer.exe or dwm.exe, which is indicative of process injection or defense evasion techniques.
Detects evidence of the BeepRAT malware (via known file names, loader behavior, and specific command-line arguments) and attempts to tamper with security software through process termination, service modification, or the addition of Windows Defender exclusions.
Detects the execution of sensitive command-line tools or environment variables (e.g., AWS CLI, MCP tools, environment secrets) triggered by AI-based development assistants such as Claude, Cursor, or Windsurf. This behavior may indicate an attacker abusing the permissions or capabilities of an AI coding assistant to perform unauthorized cloud discovery or credential access.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
Detects read access attempts to the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' registry key. Adversaries often query this key during the reconnaissance phase to identify the specific version, build number, and installation details of the host operating system, which aids in tailoring further exploitation or post-exploitation activities.
Detects bash processes executing commands that combine AWS identity verification with outbound exfiltration using curl. The pattern specifically monitors for the use of 'aws sts get-caller-identity' followed by an immediate HTTP POST transmission of data (indicated by '-d @-'), which is characteristic of attackers exfiltrating captured cloud environment metadata or temporary credentials.
Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.
Page 753 of 1168