Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,632 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the execution of known Kerberoasting tools or commands, specifically identifying the use of Rubeus, GetUserSPNs, or processes containing strings related to Kerberoasting, which indicates attempts to extract Kerberos service tickets for offline brute-force attacks.
Detects the execution of mshta.exe with arguments containing URLs, script languages (vbscript, javascript), or .hta file extensions, which is a common technique used by attackers to execute malicious code via a legitimate Windows utility.
Detects the creation of a new local user account using the Windows net.exe or net1.exe command-line utilities. This behavior is commonly used by adversaries for persistence or privilege escalation, but excludes common installer processes.
Detects the execution of script files (.vbs, .js, .wsf) using Windows script hosts (wscript.exe, cscript.exe) from common user-writable directories such as Temp, Downloads, and AppData. This behavior is often indicative of malicious files being dropped by phishing attachments or drive-by downloads and subsequently executed by an adversary.
Detects usage of the Regsvr32.exe utility to load and execute remote scriptlets from an external HTTP source. This technique, often referred to as Squiblydoo, allows adversaries to bypass application control by leveraging a trusted, signed Windows binary to proxy the execution of malicious code without registering it in the registry.
Detects attempts to bypass User Account Control (UAC) by either modifying the registry key associated with the ms-settings protocol handler or by executing the fodhelper.exe binary via cmd.exe. These techniques are commonly used by attackers to gain elevated privileges without triggering a UAC prompt.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (lsass.exe). This activity often indicates attempts to dump process memory to harvest sensitive credentials, a common technique used by attackers to facilitate lateral movement.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
This rule detects potential data exfiltration by identifying devices that make a high number of network connections (3 or more within an hour) to various remote IPs using common file transfer and email protocols (FTP, SFTP, SMB, SMTP) on their standard ports (21, 22, 445, 25, 587). This pattern can indicate an adversary attempting to exfiltrate collected data from a compromised system.
Page 693 of 866