Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,633 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the execution of common Windows system information discovery utilities (systeminfo, hostname, ver) when spawned by command interpreters or scripting engines, which is a common behavior in post-exploitation reconnaissance.
Detects execution of common Windows network configuration utilities (ipconfig, arp, route) by known command-line and script interpreters. This pattern is indicative of an attacker performing reconnaissance to gather information about the host's network settings, interfaces, and connectivity.
Detects the use of the Windows command-line utility 'reg.exe' to query sensitive registry keys or paths commonly associated with credential storage, such as SAM, SECURITY, LSA secrets, or autologon configurations. This activity is often indicative of reconnaissance or credential harvesting attempts.
Detects potentially malicious process execution behaviors, including the use of 'runas.exe' with saved credentials, the execution of 'runas.exe' by unauthorized users, and unauthorized cross-process access to sensitive Windows system processes such as lsass.exe, winlogon.exe, or services.exe, which are common indicators of credential access or privilege escalation attempts.
Detects the creation of a new local user account on a Windows system using the net.exe or net1.exe command-line utilities. This is a common technique used by attackers for establishing persistent access to a compromised system.
Detects the use of bitsadmin.exe to create or modify BITS jobs, which can be leveraged by attackers for file downloads or as a persistence mechanism to execute commands.
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
Detects the execution of the 'whoami' utility with flags that enumerate user privileges or information ('/all', '/priv'), when initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is commonly associated with attackers performing discovery after gaining a foothold on a system.
Detects the creation or modification of Windows services using sc.exe where the binary path (binpath) points to suspicious or user-writable directories such as User profiles, AppData, Temp, or Public folders, which are often used by adversaries for persistence or privilege escalation.
Detects the use of taskkill.exe or tskill.exe to forcibly terminate known security agent processes. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection during post-exploitation activities.
Page 687 of 866