Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,253 copies160 likes55,632 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
Detects the use of rundll32.exe to execute comsvcs.dll, a common technique used to create a memory dump of the LSASS process to extract credentials.
Detects the use of reg.exe to modify Windows Registry Run or RunOnce keys pointing to executable files located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, which is a common persistence technique.
Detects the use of the native Windows utility ntdsutil.exe with arguments 'ac i ntds' or 'ifm', which are commonly used to perform an 'Install from Media' (IFM) operation. This technique is frequently abused by adversaries to create a snapshot of the Active Directory database (ntds.dit) and the SYSTEM registry hive, facilitating offline credential dumping.
Detects the execution of PowerShell or PWSH attempting to download external content via web-oriented cmdlets (Net.WebClient, Invoke-WebRequest, Start-BitsTransfer) using typical obfuscation flags (e.g., -WindowStyle Hidden).
Detects the use of legitimate scripting utilities (curl, wget, powershell) to download files into common, potentially writable, or temporary directories (Temp, AppData, ProgramData, Downloads). The rule specifically excludes files that are digitally signed by trusted publishers.
Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.
Detects the use of regsvr32.exe with the /s (silent), /u (unregister), and /i (install) flags to execute a remote COM scriptlet (SCT) via an HTTP or HTTPS URL. This is a known technique (often referred to as Squiblydoo) to bypass application control by leveraging a trusted, signed Windows binary to download and execute code from a remote server.
Detects the execution of mshta.exe with a remote HTTP or HTTPS URL in the command line. This technique is commonly used by adversaries to execute malicious HTA files or scripts directly from a web server, bypassing traditional application whitelisting and browser-based security controls by leveraging a trusted, signed Windows utility.
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
Page 695 of 866