Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,602 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects broad assignments of administrative roles or specific deletion permissions for cloud storage buckets in GCP, AWS, and Azure. This includes granting 'storage.admin', 'storage.objectAdmin', or 'storage.buckets.delete' in GCP, 's3:DeleteBucket' in AWS IAM policies, or 'Storage Account Contributor'/'Owner' roles in Azure. Such assignments to service accounts or non-administrative identities could enable 'Universal Bucket Hijacking' or unauthorized data deletion.
Detects processes exhibiting behaviors indicative of process injection, such as suspicious binary names, command-line arguments related to spawning sleep processes, or ptrace system calls. This rule identifies potential attempts to inject malicious code into other processes to evade defenses or elevate privileges.
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Detects developers cloning a repository (mimicking a coding interview test) and immediately executing an anomalous binary or script hidden within the project structure. This behavior is indicative of the Void Dokkaebi threat actor's tactics.
Detects registry modifications to SyncRootManager occurring alongside cldflt.sys activity, which may indicate manipulation of cloud synchronization roots.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Identifies PowerShell using Invoke-RestMethod or Invoke-WebRequest to exfiltrate archives via HTTP POST, specifically looking for multipart/form-data boundaries in the command line.
Identifies the Python script explicitly reading developer secrets including AWS credentials, SSH private keys, and Kubernetes configuration files.
Detects command-line utilities connecting to notorious cloud storage providers heavily favored by threat actors for data exfiltration.
Detects suspicious child processes spawned by 7-Zip components.
Page 848 of 1168