Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,353 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Teampcp Shell Recon
YARA-L
Tracks shell reconnaissance parsing /var/log/auth.log for successful logins or executing env | grep AWS_.
Detects the execution of the Bun runtime executable to process a JavaScript payload named 'mcpAddon.js', which is associated with the TeamPCP supply chain attack.
Detects processes that masquerade as the legitimate 'systemd-userdbd' system service by spoofing their process name. This behavior is commonly associated with malware, such as the MYRA RAT, which uses prctl to alter its process display name to evade detection.
Detects instances where a Node.js process accesses or modifies browser-related credential, cookie, or configuration files. This behavior is indicative of unauthorized data collection or credential harvesting from locally stored web browser profiles.
Detects Node.js processes executing command-line arguments related to the collection of sensitive configuration files, credentials, and identity tokens from systems, such as Git configurations, SSH keys, NPM credentials, and Docker tokens. This behavior is indicative of an automated reconnaissance or credential harvesting phase in an attack.
Detects persistence and execution behaviors associated with the MYRA Linux RAT. The rule monitors for the installation of a malicious library (.libcache.so) via shell profile modifications, and subsequent execution attempts where a process masquerades as 'systemd-userdbd' while utilizing 'LD_PRELOAD' and fileless execution techniques (memfd_create/fexecve).
This rule detects instances where a Node.js process accesses sensitive files associated with web browsers (e.g., Login Data, Cookies) or SSH keys (e.g., id_rsa). This behavior is often indicative of credential theft or unauthorized data collection, where an adversary uses legitimate tooling like Node.js to stage or exfiltrate sensitive local files.
This rule monitors for DNS queries, network connections, and HTTP proxy requests originating from node/npm processes or targeting known infrastructure associated with the Trum3it campaign. It covers common malicious domains and specific Vercel subdomains identified as command-and-control (C2) endpoints.
Detects execution patterns associated with the Havoc C2 framework's Demon implant. This includes PowerShell loaders with encoded/non-interactive flags spawned by suspicious script interpreters, PowerShell execution spawned from explorer.exe, and suspicious remote thread injection into explorer.exe from unauthorized processes.
Detects persistence and fileless execution techniques associated with the MYRA Linux RAT. This includes monitoring for the creation of persistence files such as /usr/local/lib/.libcache.so for LD_PRELOAD hijacking and /etc/profile.d/.sh.local for shell-based persistence. It also monitors for suspicious process execution patterns where 'node' spawns a 'systemd-userdbd' masquerading process or invokes syscalls indicative of fileless execution, specifically memfd_create or fexecve.
Page 925 of 1168