Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,633 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects suspicious reconnaissance patterns on Windows endpoints. It monitors for the execution of common discovery utilities (whoami, hostname, ipconfig, systeminfo) when they are either executed in a rapid sequence (more than 2 distinct tools within 5 minutes) or when they are launched from known suspicious parent processes commonly used for script execution and evasion (e.g., PowerShell, WScript, MSHTA, etc.).
Detects execution of rundll32.exe with suspicious arguments or from non-standard file paths, often used to proxy malicious code execution, load scripts (JavaScript), or execute arbitrary DLLs from user-writable directories. The rule includes filters to exclude legitimate Windows system operations.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.
Detects potential lateral movement via Windows Management Instrumentation (WMI) by monitoring for WMI processes spawning interactive shells (cmd, powershell) or executing remote process calls using the /node syntax. Includes exclusions for common administrative tools associated with Microsoft management platforms.
Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.
Detects the execution of regsvr32.exe with command-line arguments indicative of 'Squiblydoo' style attacks, which use the signed Windows binary to proxy the execution of remote scripts or local COM scriptlets (.sct files). The rule specifically flags the use of /i with HTTP(S) URLs, loading scrobj.dll, or specific combinations of /s /u /i flags to bypass application control mechanisms.
Detects anomalous authentication patterns where a single source IP address exhibits multiple failed login attempts followed by at least one successful login within a 10-minute time window, indicative of credential stuffing or password spraying.
Detects the creation of a new local account using the 'net' utility, followed immediately by that account being added to the local administrators group on the same endpoint. This behavior is a common indicator of persistence or privilege escalation attempts.
Detects instances where an unsigned or non-trusted process attempts to access the memory of the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by threat actors to harvest credentials for lateral movement and privilege escalation.
Page 679 of 866