Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,341 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a suspicious PowerShell execution chain where a script host (wscript.exe or cscript.exe) spawns PowerShell to perform a file decoding operation via 'certutil' using a path in 'ProgramData'. This pattern is associated with the Kimsuky threat group's NUKESPED JSE loader, which uses path traversal or obfuscated filenames to stage malicious secondary payloads.
Detects anomalous registry activity by wscript.exe, specifically targeting keys associated with file association, COM object registration, or run-time startup locations. A high count of registry open operations by a scripting engine often indicates persistence installation or reconnaissance of system configuration.
Detects execution of schtasks.exe initiated by common scripting languages (wscript, cscript, powershell, pwsh) or execution involving files within the ProgramData directory, which are frequent indicators of malicious activity related to persistence or automated task manipulation.
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
Detects PowerShell activating the internal Store install-control class required for UnCanny coercion. This technique is associated with the UnCanny coercion method, which leverages a COM object to achieve privilege escalation or other malicious activities.
Detects vLLM establishing outbound network connections to fetch external media files (e.g., .mov, .mp4, .jp2) from non-private IP addresses. This activity may indicate exploitation of CVE-2026-22778, allowing for remote code execution by fetching malicious content.
Detects WebSocket connections to the AutoGen Studio MCP control plane on ports 8080 or 8081, specifically looking for URLs containing '/api/mcp/ws/' and 'server_params=', which may indicate an attempt at Remote Code Execution (RCE) via malicious server parameters.
Detects the execution of network discovery utilities (netstat, tasklist, net) or specific network-related command-line arguments (e.g., session enumeration, netstat flags) when initiated by suspicious parent processes such as fltMC.exe (Filter Manager), or script interpreters like wscript.exe or cscript.exe. This activity is indicative of post-exploitation discovery efforts.
Detects the execution of PowerShell via Command Prompt (cmd.exe) using hidden window arguments to download files from external sources or temporary directories, often associated with stages of malware delivery or post-exploitation activity.
Detects execution of fltMC.exe when located in the Temp directory, or execution of processes matching known malicious file hashes associated with this filename.
Page 941 of 1168