Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,310 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Node.js processes accessing sensitive configuration files such as .npmrc (npm authentication tokens) or .docker/config.json (docker registry credentials). This rule filters for activity within npm lifecycle script contexts (e.g., preinstall, postinstall hooks), which is a common technique used in software supply chain attacks to exfiltrate credentials.
This rule detects the execution of a process named 'systemd-userdbd' that is either spawned from suspicious parent contexts (such as Node.js or npm, or from locations like /tmp/, /var/tmp/, node_modules, or .peer/) or is running from a non-standard file path. This behavior is indicative of malware, specifically the MYRA RAT, which uses this process name as a masquerade to evade detection.
Detects Node.js processes (node, npm) attempting to access sensitive files typically associated with web browser extensions, cryptocurrency wallets, or stored secrets. This activity is indicative of credential theft or data exfiltration attempts.
Detects instances where a node.exe process, operating in an npm install or lifecycle hook context, executes a child process (such as cmd, powershell, or bash) that matches known suspicious patterns or actor-defined malicious filenames, indicative of potential supply chain compromise via malicious npm packages.
Detects instances where a node.exe process accesses common configuration, credential, or authentication files. Adversaries may leverage Node.js scripts or malicious applications to exfiltrate sensitive data such as SSH keys, AWS credentials, Docker configurations, or git configurations.
This rule detects suspicious activity related to Node.js applications that may indicate malicious manipulation of the environment or persistence mechanisms. It monitors for the loading of a specific hidden library (.libcache.so), usage of the LD_PRELOAD environment variable by node/npm processes, modifications to profile scripts, and irregular crontab entries associated with node execution. This behavior is indicative of dynamic linker hijacking or unauthorized task scheduling for persistence.
This rule detects persistence mechanisms and process execution patterns associated with the Remcos Remote Access Trojan (RAT). It monitors Registry run key modifications pointing to known Remcos installation paths, as well as process lineage involving Remcos and its associated watchdog processes (svchost.exe, rmclient.exe, fsutil.exe).
Detects node.js processes accessing sensitive configuration files, SSH keys, browser login databases, and other credential stores. This activity is indicative of malicious transitive dependencies within the npm ecosystem attempting to exfiltrate credentials during module initialization, even when top-level install scripts are restricted.
Detects the loading of the avicap32.dll library (often used for webcam/audio capture) by unexpected processes, or any file access activity within the 'C:\MicRecords\' directory, which may indicate unauthorized surveillance or credential/audio harvesting.
Detects the presence of Remcos RAT executable files or the creation of screenshot files by non-standard processes, commonly used for remote surveillance.
Page 961 of 1168