Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the download, staging, and execution of SoftEther VPN components associated with CL-STA-1062. The rule monitors for the creation of specific SoftEther files, network downloads from known actor staging infrastructure, and the execution of SoftEther binaries masquerading as VMware tools (vmtools.exe).
Detects the execution of the JuicyPotato privilege escalation tool, which exploits COM server permissions to escalate a lower-privileged account to NT AUTHORITY\SYSTEM. The rule monitors process creation events for known file names, command line patterns, and specific argument structures used by this tool.
Detects specific malicious activity patterns associated with the Miasma/Mini Shai-Hulud campaign targeting GitHub repositories. The rule monitors for unauthorized workflow creation, specific suspicious commit messages, and the use of orphan branches that impersonate dependabot or mimic specific campaign indicators.
Detects instances where svchost.exe (typically a system service host) is acting as the parent process to spawn reconnaissance utilities such as systeminfo.exe, wmic.exe, ipconfig.exe, or whoami.exe. This behavior is highly irregular as these utilities are typically invoked by users or administrative scripts, not system-level service processes, and may indicate process injection or malicious activity leveraging legitimate system processes.
Detects network activity associated with Gamaredon threat group backdoors (PteroVDoor and PteroPSDoor) exfiltrating data to S3-compatible cloud storage providers. The rule identifies suspicious outbound network requests to specific domains ('wasabisys.com', 'i3storage.com') originating from processes that are not common browsers or trusted software, or by command-line execution of PowerShell, curl, or wget.
Detects the creation of an Amazon Q Model Context Protocol (MCP) configuration file. This file is used to define tools and resources for Amazon Q, and its creation could indicate a user configuring external tool access for the AI assistant or an adversary attempting to influence its capabilities.
Detects the execution of a process named 'packet_edit_meme' on Linux systems, which is often indicative of specific malware or unauthorized tool usage.
Detects unexpected shell command execution spawned by the Amazon Q Developer VS Code extension processes (e.g., 'amazonq-lsp'). This activity is consistent with patterns related to the exploitation of CVE-2026-12957, involving the potential auto-execution of unauthorized commands via MCP (Model Context Protocol) server configurations or malicious inputs.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Page 788 of 1168