Tag
Detection of Suspicious Web Server Child Processes on Linux
1 rule 1 TTPThis brief provides detection logic to identify potential webshell activity on Linux systems by monitoring for suspicious child processes spawned by common web server applications.
Detection of Stealthy User Account Creation via ADSI
1 rule 2 TTPsAdversaries may use Active Directory Service Interfaces (ADSI) within PowerShell to create local or domain accounts, effectively bypassing standard monitoring for typical user-creation commands.
Detection of Destructive NFS File Operations
2 TTPsDetection logic identifies ransomware-like activity on NFS shares by flagging high-frequency bursts of successful WRITE, REMOVE, and RENAME operations from a single client within a one-minute window.
Automated LLM-Based User Account Compromise Triage
3 TTPsAn automated detection framework that uses Large Language Models to correlate disparate security alerts and assess potential account compromise based on behavioral indicators.
Detection of Data Exfiltration via Curl Utility
1 rule 3 TTPsAdversaries frequently abuse the legitimate curl command-line utility to exfiltrate collected sensitive data to external Command and Control (C2) servers via network protocols.
AI Agents Mimic Adversarial Behavior, Triggering Security Detections
9 TTPs 9 IOCsAI coding agents such as Claude Code, Cursor, Codex, and GStack are increasingly exhibiting behaviors on Windows endpoints that mimic adversarial tradecraft, including credential access, LOLBin usage for ingress, command-line obfuscation, and persistence mechanisms, thereby triggering existing security detection rules designed for malicious activity and posing significant false positive challenges for detection engineers.