Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,632 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects attempts to load kernel drivers using command-line utilities such as infinstall.exe, devcon.exe, pnputil.exe, or sc.exe. The detection specifically looks for these commands being initiated by powershell.exe, cmd.exe, or ServertoolLauncher.exe, which could indicate malicious activity like ransomware attempting to establish persistence or evade defenses.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
This rule detects network connections to remote URLs containing specific keywords ('festung', 'germania', 'deutsch', 'prinz', 'eugen') that are indicative of Germany-themed infrastructure potentially associated with the Prinz Eugen Ransomware. This helps identify early communication with command and control servers or data exfiltration points.
Detects attempts to delete volume shadow copies or disable system recovery features using common Windows utilities like vssadmin.exe, wmic.exe, bcdedit.exe, and cipher /w. This activity is often associated with ransomware to prevent system recovery.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
Detects the use of bitsadmin.exe to initiate file transfers, downloads, or file additions using HTTP protocols. This utility is frequently abused by adversaries for Ingress Tool Transfer by downloading malicious payloads from remote systems.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects usage of the built-in Windows utility 'certutil.exe' with parameters commonly used to download files from remote URLs, such as '-urlcache' or '-verifyctl'. This behavior is frequently exploited by adversaries to perform ingress tool transfer and fetch malicious payloads.
Detects the use of Mimikatz to perform a DCSync attack, which allows an adversary to simulate the replication process from a domain controller to extract sensitive password hashes from Active Directory.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Page 691 of 866