Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of the 'aa-exec' process with specific command-line arguments ('trinity', 'chrome', or 'flatpak') that are often associated with malicious tools, persistence, or bypass techniques.
Detects instances where code editors like Cursor or Claude execute shell commands or CLI tools often used for configuration, network activity, or credential interaction. This pattern may indicate malicious exploitation of editor configuration files (e.g., MCP configuration) or unauthorized use of the editor environment to execute shell commands.
Uses time-series aggregation to detect massive bursts of file renaming events across user directories, where files are appended with the .nightspire extension.
Detects instances where explorer.exe launches a PowerShell process originating from an LNK file, which then performs a remote download of a Node.js runtime and JavaScript implant (TonRAT) to standard Windows temporary or application data directories. This activity is indicative of the TonRAT campaign targeting hospitality front-desk systems.
Detects User Account Control (UAC) bypass attempts where known auto-elevating Windows binaries like fodhelper.exe, eventvwr.exe, or sdclt.exe are used as proxy processes to launch child processes with high integrity without user prompts.
Detects the creation or modification of the .amazonq/mcp.json file in a workspace directory. This file is automatically loaded by the Amazon Q VS Code extension and can be leveraged to achieve remote code execution (RCE) via malicious MCP server command definitions as documented in CVE-2026-12957.
Detects the execution of a specific malicious executable (COU_ITR-1_to_4_AY2026-27.exe) identified as part of the Operation DragonReturn spearphishing campaign. The campaign impersonates the Indian Income Tax Department to lure users into executing the file.
Detects instances where the Amazon Q Developer extension spawns suspicious child processes, such as bash or npx, which may indicate the execution of arbitrary commands defined in a potentially malicious .amazonq/mcp.json workspace configuration file.
Detects process execution or file creation/modification events associated with the PACKET_EDIT_MEME (pedit_cow_demo) exploit, which targets Linux kernel vulnerabilities (CVE-2026-46331) for local privilege escalation.
Detects the execution of DcRAT malware by monitoring for the creation of the specific global mutex 'Global\ShitSetupOn26126k' commonly used by this strain to enforce single-instance execution on a host.
Page 876 of 1168