Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of the legacy OSQL.exe utility to connect to a local SQL server instance and execute a query that writes output to a file. This behavior is indicative of manual data discovery or exfiltration from a local database.
Detects execution of the OSQL.EXE utility with command-line arguments indicative of database enumeration or unauthorized file operations, specifically targeting local SQL server instances.
Detects execution of node-gyp to compile native Node.js addons, which can be leveraged by attackers to execute arbitrary code or build malicious modules during project installation or development. The rule looks for binding.gyp usage and build commands initiated by npm or node processes.
Detects the creation or modification of Windows Registry Run keys that point to potential Node.js applications or scripts. This is a common persistence technique where attackers configure malicious scripts to execute upon user logon or system startup.
Detects instances of PerfWatson2.exe executing from non-standard locations (outside of known Visual Studio directories) or matching known malicious file hashes/versions. This behavior is indicative of masquerading, where a malicious binary attempts to mimic legitimate Microsoft software.
Detects the creation of suspicious IDE configuration files (e.g., .vscode/tasks.json or .claude/index.js) associated with the poisoned verana-blockchain Go module, as well as the subsequent execution of these files by the Node.js runtime. This detection aims to identify supply chain compromise attempts targeting developers.
Detects malicious npm package propagation indicative of the Miasma/Mini Shai-Hulud worm. The rule identifies suspicious patterns in AuditLogs, specifically burst npm publishes by known malicious actors or involving known malicious package names, as well as the use of weaponized GitHub Actions workflows or unauthorized snapshot branches.
Detects suspicious activities within GitHub repository logs that indicate potential supply chain attacks, including the use of unauthorized workflow names, the creation of orphan snapshot branches, dependabot impersonation attempts, commit messages containing known campaign markers, exposure of internal secrets (HAS_GCR_TOKEN), and the push of suspicious files or configuration modifications.
Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.
This rule detects potentially malicious emails that leverage Calendly as a lure. It looks for emails that pass standard authentication (SPF/DKIM/DMARC) but contain suspicious elements such as URLs redirecting to Calendly or Google, subject lines related to common social engineering themes (complaints, health inspections, etc.), or the presence of ZIP attachments that match common photo/image naming patterns.
Page 874 of 1168