Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
Detects a multi-stage in-memory delivery chain associated with Operation Poisson, where wscript.exe spawns powershell.exe to load and execute the Havoc Demon agent in memory via a VBScript stager.
This rule detects the execution of processes where the image path or parent process path originates from anonymous memory file descriptors ('/memfd:') or file descriptor links ('/proc/self/fd/'). These patterns are frequently associated with fileless malware execution where binaries are executed directly from memory to avoid disk-based detection.
Detects the installation or initiation of an OpenSSH server (sshd) process, which may indicate an attacker establishing a persistent, redundant remote access backdoor. The rule monitors for common installation/enablement patterns across Windows (via sc.exe, PowerShell WindowsCapability) and Linux (via systemctl, service) and flags instances running from non-standard or temporary directories.
Detects potentially unauthorized or malicious loading of kernel modules on FreeBSD systems using the kldload command. The rule identifies suspicious activity by flagging modules loaded from non-standard directories, kldload processes spawned by untrusted parent processes (like web servers, shells, or scripts), and instances where the process was invoked with sudo/su by non-root users.
Detects indicators of the BUMSRAKETE exploit, specifically looking for malicious binary names, staging files, and a high-frequency loop pattern involving SUID binaries (su, passwd) by unprivileged users. This pattern is consistent with a kTLS page-cache corruption exploit targeting CVE-2026-45257.
Detects instances where JavaScript runtime processes (node, npm) execute specific peer-related or verification scripts and subsequently access sensitive system files or directories, such as SSH configurations, AWS credentials, or browser data, within a 5-minute window.
Detects execution of the Tailscale or Tailscaled process that is not initiated by standard system or management processes. This may indicate unauthorized installation or use of the Tailscale VPN software for covert command and control or lateral movement, especially when combined with immediate network activity to Tailscale infrastructure or ports.
Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.
This rule detects node.js processes executing command-line arguments that attempt to perform system discovery. Specifically, it looks for node.js scripts invoking os-related modules (hostname, platform, cpus) or querying system environment variables (COMPUTERNAME, USERNAME) when the node process is launched by a parent process related to npm or node itself.
Page 804 of 1168