Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,230 copies160 likes55,471 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects network communication associated with the Bear C2 framework by identifying specific beacon URI patterns (/beacon?id=<uuid>) and connections to known non-standard listener ports (4321, 8080). The rule also monitors for process command lines containing specific hardcoded identifiers associated with this C2 implant.
This rule detects a suspicious sequence of events where a user performs an unusual device-code authentication (potentially indicative of device code phishing) followed shortly by an OAuth application consent or permission grant event. It flags potential compromise if the sign-in is new for the user or occurs in a short timeframe, with optional indicators associated with the 'maillive.sbs' phishing infrastructure.
Detects the creation of persistence mechanisms through both Registry Run keys and Scheduled Tasks within a one-hour window, specifically targeting names indicative of masquerading as legitimate update or helper components.
This rule monitors network traffic for communication with known malicious IP addresses (143.198.7.94 and 157.254.167.12) associated with the exploitation of NetScaler CVE-2026-88772 as part of the WHIPSHOT_SLAPSHOT campaign. These IPs are linked to staging, exploitation, and web shell backdoor installation activities.
Detects a suspicious two-stage browser activity sequence where a user accesses a Maze survey-builder lure (t.maze.co) followed by a navigation to a Cloudflare Workers subdomain hosting a spoofed Microsoft Authentication device-code phishing page. This pattern is indicative of a multi-stage phishing attack aimed at credential or device token theft.
Detects anomalous, high-frequency outbound connection attempts from a NetScaler appliance to internal network hosts. This pattern is indicative of potential post-exploitation lateral movement or internal network scanning by the SLAPSHOT malware (associated with CVE-2026-88772), as an appliance typically should not engage in rapid internal fan-out behavior.
Detects sign-in activity originating from a known suspicious VPN/proxy IP range targeting critical Microsoft 365 applications. The rule specifically monitors for instances where multi-factor authentication (MFA) enforcement appears to be absent or failed, suggesting a potential account compromise and subsequent data access attempt via a proxy/VPN.
Detects the execution of known tunneling binaries (ngrok, cloudflared) or network connections to tunneling service domains (ngrok.io, ngrok-free.app, trycloudflare.com), which are frequently used to establish unauthorized remote access or bypass perimeter security controls.
This rule detects modifications to the 'HideExclusionsFromLocalAdmins' registry key within the Windows Defender policy configuration. An adversary may modify this key to hide configured security exclusions from local administrators, facilitating defense evasion. The rule specifically looks for non-system process attempts to modify this key, contrasting against expected legitimate updates performed by 'gpsvc' (Group Policy Service).
This rule detects the installation of browser extensions that request highly sensitive, over-broad permissions such as proxy configuration management and web authentication provider access, combined with full host access (<all_urls>). This pattern is often indicative of malicious extensions masquerading as legitimate tools (e.g., VPNs) to facilitate credential theft or traffic interception.
Page 2 of 866