Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,603 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution patterns associated with the DirtyClone (CVE-2026-43503) exploit, which involves an unprivileged process utilizing user and network namespaces to configure IPsec XFRM Security Associations (SAs) to corrupt the kernel page cache of sensitive binaries such as /usr/bin/su.
Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.
Detects a specific execution pattern where node-gyp.exe spawns node.exe to execute an 'index.js' file. This behavior is associated with the 'Miasma' or 'Mini Shai-Hulud' threat campaigns, which utilize malicious 'binding.gyp' files within npm packages to bypass standard lifecycle script (preinstall/postinstall) security scanners.
Detects a suspicious execution chain where 'node-gyp' is observed spawning 'node' to execute 'index.js', characteristic of a 'Phantom Gyp' malicious pattern, followed immediately by the execution of a temporary JavaScript payload via the 'bun' runtime. This pattern is indicative of a multi-stage loader often used in supply chain attacks involving obfuscated payloads.
Detects a sequence of events consistent with the DirtyClone/DirtyFrag kernel exploit: first, identifying precursor activities such as namespace manipulation (unshare), kernel module loading of networking components (esp4/6, rxrpc), or specific exploit binary execution; followed by an anomalous spawn of a root shell from an unprivileged parent process within a short 5-minute window.
Detects persistence mechanisms via Registry Run keys or Startup folder shortcuts created by PowerShell, WScript, or CScript that are associated with the Gamaredon (ACTINIUM) threat group. The rule correlates these persistence events with prior execution of Ptero-family malware or suspicious encoded PowerShell commands on the same endpoint within a one-hour window.
This rule detects the execution of specific shell processes (sh, bash, crontab) where command-line arguments reference suspicious paths commonly associated with persistence mechanisms or malware, such as /var/tmp/ files or crontab spool directories.
This rule detects outbound network connections to common tunneling and proxy services (Cloudflare Tunnel, Cloudflare Workers, and Microsoft Dev Tunnels). These services are frequently abused by threat actors, such as the Gamaredon Group (ACTINIUM), to establish command-and-control (C2) channels and tunnel traffic to evade network-based detection systems.
Detects execution of system discovery and evasion commands commonly used by the Gamaredon group's Ptero-family tooling. The rule monitors for mshta.exe, wscript.exe, or cscript.exe spawning wmic, powershell, or cmd to execute queries related to virtualization artifacts (e.g., VirtualBox, VMware) or time-based evasion (e.g., Start-Sleep).
Jellyfin Ffprobe Exploit
YARA-L
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Page 854 of 1168