Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,331 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.
Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to initiate an immediate system shutdown (timer set to 0 seconds). The rule monitors for this command being invoked by common execution engines such as cmd.exe or node.exe, which is often associated with disruptive activity or ransomware attempts.
This rule detects potentially malicious process chains: first, where common Windows utilities like explorer.exe, mshta.exe, or cmd.exe spawn PowerShell with suspicious arguments (hidden windows, execution policy bypass, or encoded commands). Second, it detects when Node.js is executed from user-writable directories (Temp, AppData, Downloads, ProgramData) by PowerShell or explorer.exe, excluding legitimate nodejs installation paths. These patterns are often associated with dropper behavior or initial access stages.
Detects the execution of known network scanning and reconnaissance tools (e.g., fscan, httpdf) or commands containing specific suspicious strings often associated with threat actor activity.
Detects the creation of scheduled tasks using schtasks.exe that run at logon with highest privileges, specifically targeting known update or system binaries which may indicate malicious persistence or masquerading techniques.
Detects instances of npm package publication events initiated by known-compromised maintainer accounts (czirker, llxlr). These accounts have been identified as being used to distribute malicious packages, such as leo-aws versions, representing a software supply chain compromise.
Detects phishing attempts leveraging legitimate service redirectors such as Calendly and Google share URLs to deliver malicious photo-themed ZIP archives. The rule identifies suspicious redirect chains to Cloudflare-hosted (.cfd) domains and monitors for specific ZIP filename patterns commonly used in these campaigns to target the hospitality sector.
Detects execution of Mimikatz or the use of specific Mimikatz command-line arguments (e.g., 'sekurlsa::logonpasswords', 'privilege::debug') indicative of credential dumping, a common technique for harvesting plaintext credentials or hashes from LSASS memory.
Detects anomalous execution patterns involving Node.js and Bun runtimes, specifically identifying suspicious process lineage such as node processes spawned by node.gyp, or Bun execution patterns involving temporary files or specific command-line arguments. Additionally, it alerts on the execution of a specific known malicious file hash.
This rule detects potentially malicious process chains involving PowerShell and Node.js. It specifically flags cases where PowerShell launches PowerShell or Node.js with command lines containing suspicious file patterns (e.g., .lnk masquerading as images) or when Node.js is executed from PowerShell in user-writable directories (e.g., AppData, Temp) with command lines referencing known malicious domains.
Page 953 of 1168