Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the Drun loader, also known as Chromelevator, by identifying its characteristic use of direct syscalls to bypass EDR User Mode API hooking. It specifically looks for 'drun.exe' executing commands containing 'NtAllocateVirtualMemory', 'NtWriteVirtualMemory', or 'NtCreateThreadEx', or loading 'ntdll.dll' while having 'drun.exe' as the initiating process. It also identifies the presence of the 'drunko\drun\x64\Release' folder path.
Detects POST requests to vLLM multimodal inference endpoints that contain 'video_url' fields pointing to external resources or specific video file extensions (.jp2, .mov, .mp4). This activity is indicative of exploitation attempts related to CVE-2026-22778, where an attacker might try to inject malicious video URLs to trigger vulnerabilities in the vLLM service.
This rule detects two stages of a potential exploitation chain targeting vLLM multimodal endpoints. Stage 1 identifies POST requests to vLLM API endpoints that contain 'video_url' in the request context, which could indicate an attempt to exploit CVE-2026-22778. Stage 2 detects post-exploitation activity by looking for unexpected child processes (like shell interpreters or download utilities) spawned from vLLM or Python inference processes, suggesting successful remote code execution.
Detects unexpected child processes (e.g., shell, Python, network utilities) spawned from vLLM or Python worker processes, or suspicious file/network activity related to vLLM/Python processes. This rule aims to identify potential exploitation of CVE-2026-22778, an FFmpeg JPEG2000 heap overflow vulnerability, which could lead to arbitrary code execution within AI/ML environments.
This rule detects attempts to establish persistence by modifying Registry Run keys or creating files in Startup folders, specifically when the initiating process is 'explorer.exe'. This behavior is often associated with malware injecting into explorer.exe to maintain persistence.
Detects the execution of PowerShell or Bash commands, potentially for implant delivery, spawned from Visual Studio Code extension host processes (node.exe, code.exe, code-server, cursor). This rule specifically looks for command-line patterns associated with the GLASSWORM.WASM threat, such as 'irm', 'iex', 'curl -fsSL', 'Invoke-Expression', 'IEX', or combinations of 'powershell -Command', 'curl -fsSL', and 'bash -c'.
Detects suspicious file deletion activities using 'del' command with '/f' flag or 'Remove-Item' PowerShell cmdlet, and log clearing activities using 'wevtutil cl' or 'Clear-EventLog' PowerShell cmdlet. It also identifies Windows Event Log clearing events (Event ID 1102). The rule also includes a specific check for known malicious artifacts in the command line.
This rule detects the creation of a scheduled task named 'WindowsVaultSyncService' either through the 'schtasks.exe' command-line utility or via 'ScheduledTaskCreated' device events. This specific task name, combined with a potentially misleading description, could indicate malicious activity attempting to establish persistence or execute code.
Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. Specifically, it looks for emails where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' but differs from 'SenderMailFromDomain' (P1 envelope), and the email was successfully delivered.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Page 791 of 1168