Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,633 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects the execution of processes with command lines containing keywords associated with Snake Keylogger, such as 'snake', 'snakekeylogger', 'keylog.exe', or 'logger.dll'. This indicates potential keylogger activity on the endpoint.
Detects instances where common web browsers initiate secondary processes such as command-line interpreters (cmd.exe, powershell.exe) or scripting engines (wscript.exe, cscript.exe, mshta.exe). This pattern is frequently indicative of drive-by download attacks or initial access where an adversary uses web browser activity to execute malicious scripts or commands.
Detects a potential brute force or password spraying attempt by identifying high volumes of NTLM logon failures (Event ID 4625) originating from a single IP address, targeting multiple distinct user accounts within a 10-minute window.
This rule monitors network connection events for outbound traffic to known tunneling, development, and hosting platforms often abused by adversaries for command and control or unauthorized data egress. The rule specifically excludes common browsers, development tools, and package managers to focus on unexpected processes initiating these connections.
Detects high-frequency failed network logon attempts (Logon Type 3) originating from a single IP address. This behavior is indicative of password guessing or password spraying activity against network services.
Detects the execution of command interpreters (cmd.exe, powershell.exe, rundll32.exe) initiated by explorer.exe when the parent process command line or the child process command line indicates activity involving files located in user-writable 'Temp' or 'Downloads' directories, specifically targeting LNK files. This behavior is commonly associated with malicious shortcut files used as initial vectors for execution.
Detects outbound network connections to common Azure-related domains originating from suspicious file paths such as Temp, Downloads, or AppData subdirectories. This behavior is indicative of potential malware or unauthorized scripts executing from temporary user locations to reach out to cloud infrastructure.
Detects the execution of common system discovery utilities (whoami, ipconfig, net, etc.) by a process named 'setup.exe' originating from suspicious directories such as 'AppData\Local\Temp\' or 'Downloads'. This behavior is often indicative of automated reconnaissance following the initial execution of a potentially malicious installer or dropper.
Detects instances of the svchost.exe process running from an unexpected parent process or with unusual command-line arguments. Legitimate svchost.exe instances are typically spawned by services.exe or wininit.exe and utilize specific command-line flags. This rule identifies potential masquerading attempts where malicious actors name a process svchost.exe to evade detection.
Detects modifications to Windows Registry keys responsible for network interface DNS configuration (NameServer or DhcpNameServer) where a non-corporate, non-private, and non-loopback DNS server is set. This behavior may indicate an attempt to intercept or redirect network traffic, potentially for command and control or man-in-the-middle operations.
Page 684 of 866