Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,289 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects unauthorized or unexpected processes accessing sensitive local files containing cloud provider credentials, configuration, or environment variables. It identifies access to files such as .aws/credentials, .azure/accessTokens.json, .npmrc, and .env by processes that are not recognized cloud CLI tools. The rule prioritizes alerts involving developer-oriented applications like VS Code or Node.js, which may indicate credential theft or compromise of a developer's workstation environment.
Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.
Detects cmd.exe invoking curl.exe to download payloads from raw.githubusercontent.com, a technique commonly used for retrieving multi-stage scripts. This behavior was observed in a campaign where curl fetched secondary batch payloads from GitHub repositories into the temp directory.
Detects the creation of the 'WinSysCache' registry run key to launch 'RuntimeHost.exe', which is indicative of cryptojacking activity often associated with abuse of ScreenConnect.
Identifies the SFX module bdzsfx.x64.sfx interacting with security providers to disrupt runtime telemetry.
Detects execution of InvisibleFerret backdoor logic as a Shared Object on macOS.
Detects the sideloading of ark.x64.dll when a legitimate Bandizip.exe is executed from a non-standard path.
Detects PowerShell invoking advapi32.dll for CredEnumerate.
Detects cloud searches for sensitive keywords (credential, secret, etc.) followed by access to matching files.
Detects a new phone, authenticator application, FIDO key, or passkey registered after account recovery activity, which can establish attacker-controlled multifactor authentication.
Page 989 of 1168