Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the suspicious execution of the Bun runtime spawned as a child process of Node.js or during npm package installation, which is a pattern observed in the Miasma/Mini Shai-Hulud supply chain attacks. It monitors for child processes named 'bun' or 'bun.exe' initiated by Node.js, or activities involving 'bun run _index.js' and 'node-gyp' which are characteristic of loader chains used to facilitate credential theft during package installation.
Detects the execution of Node.js from common user-writable directories like Downloads, TEMP, or APPDATA. This behavior is indicative of malicious implants, such as TonRAT or PureRAT, which often masquerade as legitimate tools or are delivered via phishing campaigns like Photo ZIP ClickFix, where a user is tricked into launching a payload from an untrusted location.
Detects persistence mechanisms used by TonRAT and PureRAT, such as the Photo ZIP hospitality campaign, where registry Run or RunOnce keys are modified to execute malicious node.exe, .js, or .cmd files residing in user-writable directories like AppData, ProgramData, or Temp.
Detects instances of node.exe spawning wmic.exe or powershell.exe to perform security software discovery. The malware uses WMI queries or registry enumeration to identify common security agents (e.g., CrowdStrike, SentinelOne, Defender) likely to determine if it is running in a monitored environment.
Detects suspicious activity originating from web application processes (python, uvicorn, gunicorn) involving the download and execution of a payload (isp.sh), followed by the deployment and execution of a binary (lambsys) within hidden directories in /var/tmp/. This rule flags indicators of compromise such as curl/wget calls to suspicious IPs, creation of hidden directories, and execution of binary files in temporary storage locations.
Detects suspected command and control (C2) activity leveraging Cloudflare Tunnel or Workers. The rule identifies two patterns: 1) Repeated polling (>5 connections in 10 minutes) to Cloudflare infrastructure by suspicious scripting processes (e.g., PowerShell, WScript), and 2) A 'dead-drop' resolver pattern where a process contacts a Cloudflare domain, followed by a DNS query to an unrelated domain shortly thereafter, suggesting the retrieval of a new C2 address.
Detects HTTP and DNS requests directed towards the .workers.dev domain, which are commonly leveraged by threat actors for command and control (C2) redirection and domain fronting. This activity is frequently associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's infrastructure.
This rule detects potential exploitation of the DirtyClone vulnerability (CVE-2026-43503) by correlating prerequisites (XFRM state/policy creation, specific kernel module loading, or namespace manipulation) with a subsequent local privilege escalation where an unprivileged process spawns a root shell using 'su'.
Detects a two-stage activity pattern where a non-root user compiles C source code using common compilers (gcc, clang) within writable system directories (/tmp, /dev/shm, /var/tmp) using command-line arguments indicative of kernel or low-level exploits (e.g., skbuff, xfrm, static compilation), followed by the immediate execution of a newly created binary from those same directories within 60 seconds.
This rule detects attempts to tamper with Windows Defender services (WinDefend, SecurityHealthService, wscsvc) by stopping or disabling them. It covers actions performed via 'sc.exe' commands, 'Set-Service' PowerShell cmdlets, and direct modification of registry keys related to these services. The rule specifically filters out legitimate system and TrustedInstaller processes when detecting registry modifications to reduce false positives.
Page 768 of 1168