Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects when common developer environments (IDE processes like VS Code or Node.js-based tools) or AI coding assistant tools (e.g., Amazon Q) spawn suspicious child processes (like shells or network tools) that interact with sensitive cloud configuration files, environment variables, or initiate unauthorized network requests.
Detects suspicious sequences of AWS CloudTrail API calls originating from non-console or non-service-account sources (CLI, curl, etc.). The rule flags scenarios where reconnaissance via 'GetCallerIdentity' is immediately followed by sensitive IAM modifications (CreateUser, CreateAccessKey) or privilege escalation attempts (AssumeRole), which may indicate the use of exfiltrated credentials.
Detects the execution of the 'unshare' utility by non-root users with flags designed to create new user or network namespaces. This behavior is often associated with container escape attempts, privilege escalation, or efforts to bypass local security controls by creating isolated environments.
Detects evidence of the DirtyClone (CVE-2026-43503) Linux kernel privilege escalation exploit. The rule identifies a multi-stage attack chain, including the compilation of the exploit binary, creation of unprivileged user and network namespaces required for the exploit, and the use of the 'ip' utility to configure XFRM states/policies for page cache corruption.
Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.
Detects the execution of script interpreters (wscript.exe, mshta.exe, cscript.exe) where the parent process, process path, or command line originates from a removable drive (drive letters D: through Z:). This is a common pattern for USB-based malware propagation and execution.
Detects anomalous file modifications to web-accessible directories (such as index.html, dist, public, or wwwroot) by common JavaScript execution environments including node.exe, bun.exe, or npm. This activity is consistent with post-compromise tampering of web assets as observed in the Miasma/Hades campaign, likely involving the abuse of stolen repository credentials to deploy malicious content.
This rule detects potential sandbox evasion or environment analysis by identifying multiple disparate system checks (hardware, memory, processor, analysis tool, or uptime checks) performed within a short timeframe by common script interpreters like PowerShell or WScript/CScript.
Detects potential persistence attempts via cron job manipulation by unprivileged service accounts (such as www-data) or patterns indicative of the 'lambsys' threat, including usage of known writable temporary directories, non-interactive crontab installations, and aggressive execution schedules.
This rule detects a multi-stage attack chain where a WinRAR or UnRAR process, spawned by an email client (Outlook or Thunderbird), extracts files directly into the Windows startup directory. It then correlates this with the execution of common scripting or command-line tools (such as mshta, wscript, powershell, or cmd) from that same startup location within 30 seconds of the extraction event.
Page 786 of 1168