Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,053 copies47 likes38,394 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects FTP traffic with suspicious URLs referencing potentially insecure or legacy protocols.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution.
Detects anomalous activity associated with Amazon Q processes, including unauthorized access to SSH agent binaries, attempts to read SSH configuration files or keys in ~/.ssh/, and suspicious outbound network connections over port 22, potentially indicating lateral movement.
Detects the use of AppArmor administrative and diagnostic tools (aa-exec, aa-status, apparmor_parser) with non-root accounts, or usage containing flags indicative of profile bypass attempts or privilege restriction probing.
This rule detects the creation, modification, or renaming of files that are explicitly named after known security research projects, proof-of-concept exploits, or common testing artifacts (e.g., pedit_cow_demo, packet_edit_meme). These files are often associated with exploit development or security testing activities.
This rule detects unauthorized file creation, deletion, or execution activity occurring within the 'Program Files\Windows Media Player\' directory by processes other than standard Windows Media Player executables. It flags activity such as creating non-media files (executables, scripts) or using system binaries like cmd, powershell, wmic, or fsutil to perform file operations in this directory. This behavior is indicative of potential masquerading or persistence techniques where an attacker places malicious payloads in a seemingly legitimate system location.
This rule detects processes launched from common user-writable or temporary directories (Downloads, AppData/Temp, etc.) that initiate a network connection more than 60 seconds after the process start time. This behavior is indicative of a delayed C2 beaconing or a dormant malicious payload being activated.
Detects the creation or modification of '.amazonq.mcp.json' files associated with the Model Context Protocol (MCP) in VS Code or similar IDE environments, alongside the subsequent spawning of shell interpreters (bash, sh, cmd, powershell, python, npx) from these IDE processes. The rule further flags these events as 'HIGH' priority if the command line references sensitive patterns like AWS credentials or SSH/AWS paths, suggesting potential credential harvesting or unauthorized post-exploitation activity originating from the IDE environment.
Detects instances where the Amazon Q language server or VS Code extension host spawns suspicious child processes, such as shells, interpreters (python, bash, powershell), or utilities commonly used to query or extract AWS cloud credentials.
Detects attempts to modify or bypass AppArmor security profiles using utilities such as aa-complain, aa-disable, or apparmor_parser, correlated with process execution involving user namespace unsharing (e.g., via unshare or CLONE_NEWUSER/CLONE_NEWNET). This combination suggests an attacker attempting to weaken host security controls or perform a container breakout or privilege escalation by manipulating kernel-level namespaces and security policies.
Page 906 of 1168