Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,634 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects suspicious reconnaissance patterns on Windows endpoints. It monitors for the execution of common discovery utilities (whoami, hostname, ipconfig, systeminfo) when they are either executed in a rapid sequence (more than 2 distinct tools within 5 minutes) or when they are launched from known suspicious parent processes commonly used for script execution and evasion (e.g., PowerShell, WScript, MSHTA, etc.).
Detects execution of rundll32.exe with suspicious arguments or from non-standard file paths, often used to proxy malicious code execution, load scripts (JavaScript), or execute arbitrary DLLs from user-writable directories. The rule includes filters to exclude legitimate Windows system operations.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.
Detects the use of tasklist.exe, qprocess.exe, or PowerShell 'Get-Process' commands to enumerate running processes on a system. This behavior is often associated with discovery efforts by adversaries to identify security software or target applications, excluding standard system processes as sources.
Detects the use of built-in Windows utilities (vssadmin, wmic, wbadmin) to delete shadow copies or backup catalogs. This activity is commonly associated with ransomware and data destruction attacks aiming to inhibit system recovery.
Detects native Windows command and scripting interpreters (e.g., cmd.exe, powershell.exe, mshta.exe) initiating external network connections to multiple distinct IP addresses, which is often an indicator of automated C2 beaconing or lateral movement activity.
Detects the creation or modification of Windows Registry Run keys, which are a common mechanism for achieving persistence by executing programs automatically upon user logon or system boot. The rule excludes common, legitimate software update or installation processes that frequently interact with these keys.
This rule detects potentially unauthorized or suspicious Remote Desktop Protocol (RDP) activity by monitoring for instances of 'mstsc.exe' initiated with specific command-line arguments, or identifying child processes spawned by RDP-related binaries ('mstsc.exe', 'rdpclip.exe') that are not typically associated with standard RDP functionality.
Detects cross-process access (such as memory read/write) by an unsigned process against sensitive system processes (e.g., lsass.exe, svchost.exe, explorer.exe). This activity is often a precursor to credential dumping, process hollowing, or other forms of process injection used by malicious actors to achieve persistence or privilege escalation.
Page 678 of 866