Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,633 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the execution of processes with command-line arguments characteristic of the Mimikatz tool, specifically the 'sekurlsa', 'lsadump', and 'privilege::debug' modules used for credential dumping and process debugging.
Detects the use of regsvr32.exe to load a remote COM scriptlet via a URL. This technique, commonly known as Squiblydoo, allows adversaries to bypass application whitelisting and proxy the execution of malicious code, as regsvr32.exe is a trusted Windows binary.
Detects execution of PsExec or PsExec64 using the -accepteula flag targeting a remote host specified by a Universal Naming Convention (UNC) path. This pattern is commonly used for legitimate remote administration but is also a hallmark of lateral movement and remote code execution by attackers.
Detects the execution of mshta.exe with suspicious command-line arguments, including the use of 'javascript:', 'vbscript:', or HTTP/HTTPS URLs. These patterns are commonly used to proxy the execution of malicious HTML Applications (HTA) or scripts to bypass security controls. The rule includes an exclusion for legitimate Microsoft-signed mshta.exe processes that do not contain these suspicious indicators.
Detects the use of nslookup.exe to query DNS TXT records from non-Microsoft signed processes. This behavior is often associated with DNS-based Command and Control (C2) channels or data exfiltration techniques where small amounts of data are encoded within DNS TXT records.
Detects instances of rundll32.exe being used to load DLL, OCX, or CPL files from suspicious locations such as user-writable directories (Temp, AppData, Downloads, etc.) or UNC paths. This behavior is indicative of an adversary attempting to execute malicious code using a trusted Windows system binary (LOLBin).
Detects the use of the sc.exe utility to create a new service on a remote system by specifying a path using a UNC share. This behavior is indicative of lateral movement, where an attacker attempts to execute code on a remote host by installing a service via SMB/Admin Shares.
Detects the use of bitsadmin.exe to create or modify BITS transfer jobs, a technique often used by adversaries to download payloads or exfiltrate data under the guise of background system tasks.
This rule detects cross-process memory access attempts against the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by attackers to dump credentials (e.g., cleartext passwords, NTLM hashes, Kerberos tickets) for lateral movement and privilege escalation. The rule filters out known legitimate processes and system-signed components to reduce false positives.
Detects execution of PsExec or PsExec64 using the -accepteula flag targeting a remote host specified by a Universal Naming Convention (UNC) path. This pattern is commonly used for legitimate remote administration but is also a hallmark of lateral movement and remote code execution by attackers.
Page 690 of 866