Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized processes attempting to access sensitive browser files such as Login Data, Cookies, or Web Data for Google Chrome or Microsoft Edge. This activity is indicative of credential theft, where malicious actors attempt to extract stored passwords or session cookies from web browsers.
Detects potential process injection attempts by Atlas RAT or ValleyRAT malware into system processes such as svchost.exe or explorer.exe. The rule identifies suspicious execution originating from user-writable directories (e.g., Temp, AppData) when spawning these critical processes, which deviates from standard system-based spawning patterns.
Detects a process hollowing technique where legitimate system processes (svchost.exe or notepad.exe) are spawned by non-standard parent processes, followed by suspicious memory manipulation API calls (such as NtUnmapViewOfSection, NtWriteVirtualMemory, or NtResumeThread) from an non-system process, indicative of malicious code injection.
Detects the deployment of the IronWorm eBPF kernel rootkit by monitoring for unauthorized bpf() syscalls, specifically when invoked by suspicious parent processes such as npm or shells. The rule tracks the loading of eBPF programs, the usage of tools like bpftool, tc, and ip, and the presence of specific file artifacts and indicators associated with rootkit behavior like hiding PIDs or network sockets.
Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.
Detects anomalous process behavior characterized by rapid access to multiple sensitive credential files or enumeration of critical environment variables (e.g., cloud, AI, or cryptocurrency wallet keys). This behavior aligns with the mass credential harvesting techniques observed in the IronWorm/Shai-Hulud campaign.
This rule detects potential ransomware activity by monitoring for QEMU virtualization software spawning child processes followed by mass file encryption (using extensions .threeamtime or .bqtlock) and the creation of typical ransomware note files (e.g., RECOVER.txt, README.txt).
Detects the execution of non-JavaScript ELF binaries (e.g., Rust-compiled binaries) from within npm package directories or specific setup paths, typically during 'preinstall' or 'postinstall' npm lifecycle hooks. This behavior is indicative of potential supply-chain attacks where malicious code is executed during dependency installation.
Detects suspicious credential harvesting activities, specifically identifying processes performing a sweep of multiple sensitive configuration files (e.g., AWS, Kubernetes, SSH keys, npm, git) or processes accessing /proc/self/environ to enumerate environment variables for sensitive data.
This rule detects modifications to Windows Registry persistence keys (Run keys, ControlSet, and file class associations) where the value being written contains strings associated with virtualization (qemu, .qcow2), potential malware/tools (bisrv.dll), or sensitive components (vault.db, TPMProfiler). This behavior is indicative of an adversary attempting to establish persistence or inject malicious modules via registry hooks.
Page 797 of 1168