Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,318 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where npm or node.exe spawn shell interpreters (cmd.exe, powershell.exe, bash, sh) with suspicious command-line arguments indicative of malicious activity, such as credential harvesting or unauthorized script execution within package lifecycle hooks (postinstall, preinstall). This is associated with supply chain attacks like the Miasma infostealer and MYRA RAT.
Detects instances where Node.js, npm, or npx processes attempt to access sensitive configuration files including AWS credentials, Claude API keys, or .env files, which is a common behavior of the Miasma infostealer used in supply chain compromise campaigns to harvest cloud and AI secrets.
Detects unauthorized access to SSH private key files by processes spawned directly or indirectly from npm lifecycle hooks (e.g., postinstall, preinstall). This behavioral pattern is associated with supply chain attacks such as the Miasma infostealer, where malicious dependencies attempt to exfiltrate credentials during the installation phase.
Detects fileless execution of the MYRA Linux RAT, which utilizes memfd_create and fexecve to load an ELF binary directly into memory. The detection identifies malicious payloads masquerading as the systemd-userdbd process when spawned by non-standard parent processes such as shell interpreters, node, or npm, as well as abnormal command-line arguments.
Detects Remcos RAT establishing persistence by writing to Windows Registry Run keys from processes executing out of AppData, Temp, or ProgramData directories. The rule specifically looks for registry modifications in Run or RunOnce keys where the image path or the value details point to suspicious, writable directories commonly abused by malware.
Detects cross-process injection techniques associated with Remcos RAT, such as VirtualAllocEx, WriteProcessMemory, and remote thread creation. The rule identifies suspicious interaction with critical Windows system processes (e.g., explorer.exe, svchost.exe) by non-system processes, often indicative of malware injecting code to maintain persistence or evade detection.
Detects persistence mechanisms used by the MYRA Linux RAT, specifically targeting the modification of /etc/ld.so.preload, the deployment of a malicious library (.libcache.so) to /usr/local/lib/, and suspicious shared object file creation in temporary directories (/tmp or /dev/shm) initiated by Node.js or npm processes. This behavior was observed in the Polymarket Trap npm supply chain campaign.
Detects a malicious post-install technique where an npm package utilizes node.exe to perform an 'npm pack' and overwrite critical files within the node_modules directory. This behavior, observed in the Miasma/Polymarket Trap, is designed to bypass static analysis performed during initial installation by swapping legitimate files with malicious variants after the fact.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects unauthorized or anomalous modifications to local vector database files (e.g., ChromaDB, FAISS SQLite) by non-standard processes, indicating an attacker attempting to poison the AI's retrieval context directly. The rule specifically looks for file modifications or renames of common vector database files (chroma.sqlite3, faiss_index.index, index.faiss) where the initiating process is not a standard AI/ML runtime (python.exe, node.exe, docker.exe) and there is an outbound network connection from that process to a non-localhost IP.
Page 962 of 1168