Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,405 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where common shell or command-line tools are spawned by Amazon Q processes (amazonq-language-server) or development-related processes (Code.exe, node) shortly after the creation or access of the 'mcp.json' configuration file within an '.amazonq' directory. This behavior may indicate an attacker using development tool vulnerabilities or compromised extensions to execute arbitrary commands.
This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.
Detects execution of exploit binaries associated with CVE-2026-46331 (pedit COW) or the abuse of legitimate 'tc' (traffic control) and 'unshare' utilities to perform page cache corruption and privilege escalation in user namespace contexts.
Detects the creation of an mcp.json file within the .amazonq directory, followed shortly by the execution of suspicious child processes (bash, python, curl, etc.) by VS Code (Code.exe). This pattern is often indicative of an adversary abusing developer tools or IDE extensions to perform credential discovery or data exfiltration from a development environment.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
Detects the execution of OSQL.EXE to perform a database table dump to a file on the local system. The rule specifically monitors for OSQL connecting to a local SQL instance (localhost or 127.0.0.1) and utilizing the output flag (-o) to save query results to a file with a .sql extension, which is a common indicator of unauthorized data staging or collection.
This rule detects DNS queries to known public tunneling service domains, such as devtunnels.ms, loophole.site, loca.lt, and bore.pub, originating from processes other than the legitimate developer tunneling tools (devtunnel.exe, code.exe, code-tunnel.exe). This activity is highly indicative of unauthorized remote access or command-and-control communication.
This rule detects various techniques used by the Lambsys malware for persistence, watchdog monitoring, and cryptocurrency mining on Linux systems. It monitors for crontab modifications, the execution of hidden watchdog scripts in /var/tmp, the usage of pgrep to monitor the miner, and the detachment of processes via nohup.
This rule detects suspicious activities related to SSH credential theft and lateral movement on Linux systems. It monitors for interactive shells or utilities like cat, python, and bash accessing common SSH configuration files (~/.ssh/id_rsa, authorized_keys, etc.), as well as automated SSH/SCP sessions using suspicious configurations (BatchMode=yes, StrictHostKeyChecking=no) or specific malicious payloads.
This rule detects activities related to the DirtyClone exploit (CVE-2026-43503), including the execution of the exploit binary, the compilation of the exploit from source code using gcc, the use of unshare to prepare network and user namespaces, and suspicious execution of su by non-standard parent processes indicating potential post-exploit root shell acquisition.
Page 907 of 1168