Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,633 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the loading of .NET assemblies (mscorlib.dll, System.dll, System.Net.dll, System.IO.dll) by processes whose filenames start with 'GST' or contain 'Debit' or 'Invoice'. This pattern is indicative of the Remcos RAT loader attempting to execute without writing the assembly to disk, a technique often used to evade detection.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Detects the execution of command interpreters (cmd.exe, powershell.exe, rundll32.exe) initiated by explorer.exe when the parent process command line or the child process command line indicates activity involving files located in user-writable 'Temp' or 'Downloads' directories, specifically targeting LNK files. This behavior is commonly associated with malicious shortcut files used as initial vectors for execution.
Detects high-frequency failed network logon attempts (Logon Type 3) originating from a single IP address. This behavior is indicative of password guessing or password spraying activity against network services.
Detects instances of the svchost.exe process running from an unexpected parent process or with unusual command-line arguments. Legitimate svchost.exe instances are typically spawned by services.exe or wininit.exe and utilize specific command-line flags. This rule identifies potential masquerading attempts where malicious actors name a process svchost.exe to evade detection.
Detects modifications to Windows Registry keys responsible for network interface DNS configuration (NameServer or DhcpNameServer) where a non-corporate, non-private, and non-loopback DNS server is set. This behavior may indicate an attempt to intercept or redirect network traffic, potentially for command and control or man-in-the-middle operations.
This rule detects a suspicious sequence of file creation events occurring within a 60-second window in a temporary directory. The pattern involves the creation of a .lnk file, a .pdf file, and an executable (.exe or .dll). This behavior is characteristic of malicious activity where a shortcut file is used to lure a user into opening a document that subsequently executes a malicious payload.
Page 683 of 866