Steve Lon
@trust1nCompletionist
0 followers15 downloads47 copies1 like382 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
1
1
1
1
1
Platforms
2
1
1
MITRE Techniques
2
2
1
1
1
CVEs
1
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
Detects the creation of abnormally large Windows shortcut (.lnk) files. This is a known TTP of APT36 (Transparent Tribe), who embed PDF content within LNK files to inflate their size and masquerade as legitimate documents to deceive users. The rule specifically looks for .lnk files with a size greater than 1MB.