Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized SSH public key authentication to the vmanage-admin account on Cisco SD-WAN devices. This behavior is indicative of potential unauthorized persistence or account manipulation using SSH keys. The rule also references monitoring for changes to the PermitRootLogin configuration, which is a common indicator of attempts to enable root access via SSH.
This rule detects potentially malicious modification of sensitive configuration files (e.g., /etc/ssh/sshd_config, /etc/passwd, /etc/shadow) or the execution of chmod/chown commands on sensitive files. It also flags common persistence/backdoor techniques such as modifying SSH settings to allow root login or applying dangerous permissions (777, setuid, setgid) to binaries, which could facilitate privilege escalation.
Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.
Detects Visual Studio Code or Cursor IDE spawning a node.js process that executes a payload disguised as a .woff2 font file. This behavior is associated with supply chain attacks where malicious npm packages use hidden VS Code workspace tasks (e.g., folderOpen) to execute arbitrary code.
Detects unauthorized access to sensitive credential and configuration files associated with AI development tools (Cursor, Claude, Gemini) and cloud providers (AWS, GCP) by the Miasma worm, which seeks to steal environment configuration and authentication data.
Detects HTTP responses containing JavaScript files larger than 1 MB, which is a signature behavior of the Bluekit PhaaS platform. This technique involves serving periodically rotated, obfuscated JavaScript bundles to evade static hash-based detection mechanisms.
Detects encrypted WebSocket sessions over non-standard ports or TLS traffic patterns indicative of Bluekit Phishing-as-a-Service (PaaS) session token exfiltration to unauthorized command and control (C2) infrastructure.
Detects the creation of ZIP/RAR/7z archives by processes residing within the Turla STOCKSTAY installation directory (%LOCALAPPDATA%\Programs\SMN\) or by known STOCKSTAY malicious components. This behavior is associated with the STOCKSTAY 'Get' command, which gathers files and archives them in-memory for base64-encoded exfiltration.
Detects instances where a Python process is spawned by npm or node and subsequently attempts to access sensitive browser or cloud credential files. This pattern is characteristic of malicious npm packages used for credential theft.
Detects npm or node processes spawning shell interpreters (cmd.exe, powershell.exe) during package installation, which subsequently execute download utilities (curl, wget, certutil, bitsadmin). This behavior is characteristic of malicious npm packages attempting to stage payloads during the 'preinstall' or 'postinstall' hooks.
Page 817 of 1168