nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects instances where an AI agent process (e.g., Moltbot, ClawdBot) performs a web search or HTTP request containing suspicious internal identifiers (like API keys or project names) as URL parameters. This behavior is a hallmark of 'search-and-leak' exfiltration tactics, often triggered by indirect prompt injection.
Detects potential Sliver C2 implant activity on Linux systems based on process execution patterns, such as in-memory execution via memfd or process name masquerading from temporary directories.
Detects the exploitation of CVE-2026-24061, a critical authentication bypass vulnerability in GNU telnetd. The rule identifies when the 'telnetd' process spawns '/usr/bin/login' with the '-f' flag, which skips authentication and grants the attacker remote access.
Detects exploitation attempts and worm-like scanning behavior targeting Next.js applications, characteristic of the EtherRAT malware. The rule identifies web requests with the 'x-middleware-subrequest' header (CVE-2025-29927) or scanning of sensitive paths like '/_next/data/' from internal sources.
Detects the loading of a vulnerable Baidu Antivirus driver (CVE-2024-51324), a technique used by DeadLock ransomware, followed by the termination of a security product process on the same host. This indicates a 'Bring Your Own Vulnerable Driver' (BYOVD) attack to disable defenses.
Detects the creation of executable files (.exe, .dll) in the `%TEMP%\Lightshot` directory. This directory is used as a staging area by the malicious fake Clawdbot VS Code extension to drop its payloads, including a weaponized ScreenConnect client.
Detects incoming network traffic from external IP addresses to common AI agent and model gateway ports (e.g., Ollama, vLLM, ClawdBot). This could indicate an exposed, unauthenticated service vulnerable to hijacking, potentially leading to unauthorized access or data exfiltration.
This rule detects the specific artifacts associated with the '01flip' ransomware. It triggers when a ransom note named 'RECOVER-YOUR-FILE.TXT' is created, followed by the rapid renaming of more than 10 files on the same host with the '.01flip' extension. The correlation is based on the hostname and the process command line within a 5-minute window, indicating a coordinated ransomware attack.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, Publisher, Visio, Access) spawns a suspicious child process. The child processes include commonly abused Windows utilities such as PowerShell, cmd, wscript, cscript, mshta, rundll32, certutil, bitsadmin, and regsvr32. This behavior can indicate malicious code execution originating from an Office document, often associated with phishing or document-based malware.
Detects potential Remcos RAT installation by correlating the creation of an executable in a user's AppData directory with the creation of a registry run key for persistence.
Page 68 of 70