Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
Detects execution of AWS CLI subcommands used for credential or identity enumeration (e.g., sts get-caller-identity, iam get-user) when spawned from Amazon Q-related or development environment processes (Node.js/VS Code). This behavior is indicative of potential malicious activity involving a compromised MCP server configuration file (CVE-2026-12957).
Detects unauthorized or suspicious access to sensitive files (AWS credentials, config, or SSH private keys) by processes spawned as children of common Integrated Development Environments (IDEs) or language runtimes. This pattern is characteristic of exploit chains like CVE-2026-12957, where malicious workspace configurations trigger automatic server execution, inheriting developer environment access to sensitive credential stores.
Detects execution of the tc (traffic control) utility with pedit actions by non-root users. This pattern is indicative of exploitation attempts targeting the Linux kernel act_pedit subsystem (CVE-2026-46331), which can lead to page cache corruption and local privilege escalation.
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects anomalous child process execution (e.g., bash, sh, npx, node) spawned directly by AI coding assistants or IDE extensions (Claude Code, Cursor, Amazon Q). This behavior, specifically involving auto-executed configurations like mcp.json, is indicative of exploitation attempts targeting AI coding environments where remote code execution (RCE) can be achieved via untrusted configurations or injected prompts.
Detects execution of specific malware samples identified as DcRAT that perform environment checks, such as timing analysis using GetTickCount64 and Sleep, combined with system configuration lookups to identify sandbox or analysis environments.
Detects the Amazon Q Developer language server or extension host spawning suspicious child processes (bash, sh, zsh, python, node) that execute commands involving AWS STS identity retrieval, external data exfiltration via network tools like curl/wget, or direct references to AWS credential environment variables. This pattern is indicative of potential Remote Code Execution (RCE) via malicious Model Context Protocol (MCP) auto-execution.
Detects the creation of GitHub Actions workflow files within the .github/workflows/ directory that mimic Dependabot naming conventions while containing suspicious indicators associated with the Miasma/Mini Shai-Hulud supply chain attack. Indicators include hardcoded secret references, specific operational markers like 'RevokeAndItGoesKaboom', and unauthorized OIDC token permissions.
Detects adversary activity associated with CL-STA-1062, specifically the use of archive extraction tools to unpack content into hidden or masqueraded ProgramData directories (VMware, Microsoft, Intel). The rule also monitors for process execution and the creation of scheduled tasks that utilize these specific staging paths.
Page 789 of 1168