Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of AWS STS commands to identify the caller's identity in conjunction with suspicious outbound POST requests. This pattern is commonly used by adversaries to verify compromised cloud credentials or enumerate permissions within an AWS environment.
This rule monitors process execution events for the 'aa-exec' utility, a tool often used in containerized environments (such as AppArmor) or specific runtime configurations, when invoked with specific command-line arguments (-p trinity, -p chrome, or -p flatpak). These patterns are indicative of specialized container or sandbox execution activities that may warrant investigation in specific enterprise environments.
This rule monitors for suspicious child processes (such as bash, curl, or aws cli) spawned by the Amazon Q IDE language server. These patterns are indicative of potential abuse of IDE plugins or language servers to execute system commands, exfiltrate credentials, or interact with cloud APIs, potentially utilizing custom MCP (Model Context Protocol) configurations.
Detects network communication associated with DcRAT, specifically identifying DNS lookups for the known C2 domain kkxqbh.top or network connections to port 2671 originating from suspicious or specific host processes.
Detects unauthorized or suspicious AWS CLI operations and sensitive IAM API calls initiated from developer tooling processes like VS Code (including the Amazon Q extension host). This behavior is often associated with the exploitation of MCP (Model Context Protocol) auto-execution vulnerabilities, where attackers attempt to use compromised developer environments to escalate privileges or exfiltrate cloud credentials.
Detects a suspicious UAC bypass pattern associated with the DcRAT malware, where a process relaunches itself using the 'runas' verb via ShellExecuteW to escalate privileges. The rule specifically monitors for instances where an executable triggers a secondary process launch of itself, filtering out standard Windows administrative utility parents.
Detects unexpected subprocesses (bash, sh, npx) spawned by the Amazon Q language server process. This behavior is indicative of a potential exploit targeting the Model Context Protocol (MCP) auto-execution vulnerability (tracked as CVE-2026-12957), where a malicious .amazonq/mcp.json workspace configuration is used to gain unauthorized code execution.
Detects potential second-stage deployment of the Kazuar backdoor on Windows hosts, following initial access activity associated with the Gamaredon group (using Ptero-family implants). The rule monitors for a sequence involving PowerShell-based loaders (PteroPaste, PteroVDoor, PteroSetup, or PteroDee) followed by or combined with suspicious encoded PowerShell commands and the creation of Kazuar-specific named pipes or artifact markers.
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
This rule detects potentially malicious inbound HTTP POST requests directed at an API endpoint associated with public build directories. The detection logic monitors for suspicious user agents (e.g., Python requests), specific known malicious flow identifiers, known attacker IP addresses, and payload indicators such as OS command injection or execution patterns (e.g., __import__, os.system).
Page 761 of 1168