Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,331 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the Amazon Q VS Code extension or associated language server spawning shell interpreters with suspicious command-line arguments, such as -c flags, network utility commands (curl, wget), or AWS STS credential retrieval commands, potentially indicating exploitation of CVE-2026-12957 (MCP auto-execution abuse).
Detects potential DcRAT staging activity identified in Operation DragonReturn. The rule monitors for the creation of JPEG files in suspicious locations by non-browser processes (Sysmon EID 11), and the loading of .NET DLLs or files from staging directories by LOLBins such as mshta.exe, regsvr32.exe, or rundll32.exe (Sysmon EID 7).
Detects outbound network connections initiated by common CLI tools (curl, wget, python, node) when spawned as child processes of an IDE or extension host (e.g., VS Code). This pattern is indicative of potential AWS credential exfiltration where an adversary manipulates IDE configurations (like .amazonq/mcp.json) to execute unauthorized network requests containing AWS secrets.
Detects instances where the Amazon Q Developer extension spawns suspicious child processes, such as bash or npx, which may indicate the execution of arbitrary commands defined in a potentially malicious .amazonq/mcp.json workspace configuration file.
Detects instances where the /bin/su binary is executed by a non-root process but succeeds in launching as the root user. This behavior is indicative of potential memory-based privilege escalation exploits, such as page cache poisoning (e.g., pedit COW variants), which allow unauthorized SUID binary execution without modifying the binary on disk.
This rule detects unprivileged processes executing Linux traffic control (tc) commands that leverage the 'act_pedit' action. Such behavior is highly unusual for non-root users and matches the exploitation pattern of the CVE-2026-46331 pedit copy-on-write (COW) kernel vulnerability, which attempts to escalate privileges via netlink socket operations.
Detects DcRAT loader attempts to disable AMSI scanning by patching the AmsiOpenSession function in amsi.dll memory using VirtualProtect, a technique associated with malware such as DcRAT and historical campaigns like Operation DragonReturn.
Detects instances where the node.exe process attempts to read SSH configuration files or private key files (id_rsa, id_ed25519, etc.). This behavior is often associated with malicious packages or compromised scripts attempting to exfiltrate SSH credentials from the local file system. The rule includes exclusions for common node package manager installation paths and processes that appear to be performing legitimate package management or post-installation tasks.
Detects instances where node.exe processes attempt to access sensitive configuration files, specifically AWS credential or configuration files, or .env files associated with common package installation or session management operations. This behavior may indicate an attempt to exfiltrate credentials from a developer or build environment.
This rule monitors for potential keylogging behavior by detecting the use of Windows hooks (SetWindowsHookEx, GetAsyncKeyState), the creation of files named 'keylogger.dat' or 'keylogger', and files created in AppData with a .dat extension by unauthorized processes. It includes exclusions for common legitimate system and application processes to minimize noise.
Page 957 of 1168