Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,632 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the modification of the 'LoadMacroProviderOnBoot' registry value in Microsoft Outlook. Enabling this setting can cause Outlook to load macros upon startup, which is a technique often leveraged for persistence or malicious code execution.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
This rule detects potentially malicious usage of rundll32.exe by monitoring for specific command-line indicators associated with APT28, as well as the execution of DLL files from commonly abused directories like Temp, tmp, or ProgramData.
Detects the creation or modification of the VbaProject.OTM file, which stores VBA macros for Microsoft Outlook, by a process other than the Outlook application (OUTLOOK.EXE). This is a common technique used to deploy malicious macros for persistence or code execution within the Outlook environment.
This rule monitors for the creation of specific file artifacts associated with the APT28 SimpleLoader malware, including malicious DLLs, steganographic image payloads, and configuration files dropped into non-standard or diagnostic directories.
Detects instances where explorer.exe loads a DLL file from within C:\ProgramData. This behavior is often associated with adversary activity attempting to hide malicious modules in directories that may have permissive write access or are excluded from routine scans, including techniques used by Covenant frameworks or C2 agents.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
Detects the use of bitsadmin.exe to create or modify BITS jobs, which can be leveraged by attackers for file downloads or as a persistence mechanism to execute commands.
Detects the execution of the 'whoami' utility with flags that enumerate user privileges or information ('/all', '/priv'), when initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is commonly associated with attackers performing discovery after gaining a foothold on a system.
Detects the use of taskkill.exe or tskill.exe to forcibly terminate known security agent processes. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection during post-exploitation activities.
Page 686 of 866