nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
This rule detects the execution of an executable (.exe) file from a user's temporary directory (AppData\Local\Temp). This behavior is often associated with malware or suspicious activity, as temporary directories are frequently used by adversaries for staging and executing payloads. The rule specifically excludes executables with 'setup' in their command line to reduce false positives from legitimate software installations.
This rule detects instances where powershell.exe is launched by cmd.exe, and the command line does not contain 'system32'. This pattern can indicate an attempt to execute PowerShell scripts or commands from non-standard locations, potentially bypassing security controls or executing malicious code.
This rule detects the instantiation of the TieringEngine COM object, identified by the GUID '50d185b9-fff3-4656-92c7-e4018da4361d', via process creation events. This activity is associated with CVE-2026-33825, a zero-day vulnerability that could be exploited by malware like RedSun. The rule specifically looks for this GUID in the command line of newly created processes.
This rule detects the creation or connection to a named pipe with the specific name 'REDSUN'. This activity is associated with the RedSun PoC (Proof of Concept) for CVE-2026-33825, a zero-day vulnerability in Windows Defender. The rule looks for events indicating named pipe creation or connection across various security event sources, including Falcon native events and Sysmon events (Event IDs 17 and 18).
Detects the creation or modification of registry keys related to SyncRoots containing the hardcoded string 'SERIOUSLYMSFT', which is indicative of the RedSun exploit (CVE-2026-33825) abusing the Cloud Files API.
Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.
This rule detects the execution of hidden shell scripts (files starting with a dot) within the /tmp/ or /var/tmp/ directories on Linux systems, specifically when initiated using `nohup`. This behavior is often associated with malware or post-exploitation activities to maintain persistence or execute malicious payloads discreetly. The rule looks for process execution events where the command line includes `nohup` and references a hidden `.sh` file in a temporary directory.
This rule detects the specific command and control check-in format used by the PhantomPull loader to retrieve the final PhantomPulse payload. It monitors for the URL pattern '/v1/updates/check?build=payloads' within process command lines on Windows systems, indicating communication with the PhantomPulse C2 infrastructure.
Detects suspicious execution of `wget` or `curl` attempting to retrieve a payload named exactly `/.shell`. This activity is indicative of the Masjesu botnet's C2 download pattern, where it attempts to download a bash shell file after exploiting a target to initiate device infection and propagation routines.
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
Page 56 of 70