Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,624 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects modifications to Active Directory user accounts by monitoring Security Event ID 4738. The rule filters out service accounts (those ending with '$') and ensures the target username is populated.
This rule detects suspicious WebSocket upgrade attempts targeted at Microsoft authentication endpoints, typically used by 'Bluekit' or similar Phishing-as-a-Service (PhaaS) platforms to establish a persistent connection or tunnel for credential harvesting via adversary-in-the-middle attacks. It flags traffic from non-private IP addresses that exhibit specific patterns associated with proxy usage or automated tooling (e.g., Python/curl) combined with WebSocket upgrade headers.
Detects the use of 'hdiutil' to mount disk images with the '-nobrowse' flag, initiated by common command-line or scripting interpreters. The '-nobrowse' flag prevents the mounted volume from appearing on the desktop or in Finder, which is a common technique used by attackers to mount malicious disk images stealthily to facilitate execution of payloads while avoiding user detection.
This rule monitors DeviceNetworkEvents for outbound network connections to a specific IP address (142.111.194.73), destination port (8640), or URL path (/dj5FZEiLnA/) associated with the 'GiftedCrook' command and control infrastructure.
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
This rule monitors DeviceNetworkEvents for outbound network connections to a specific IP address (142.111.194.73), destination port (8640), or URL path (/dj5FZEiLnA/) associated with the 'GiftedCrook' command and control infrastructure.
This rule detects suspicious PowerShell execution patterns involving scripts or payloads stored within specific directory paths (ProgramData\WC3\ or ProgramData\wt1). It flags instances where PowerShell commands include reflective loading techniques ('IEX' or 'Invoke-Expression') while referencing files in these paths, which is often associated with fileless malware execution or malicious loaders.
This rule detects the creation of shortcut (.lnk) files within the Windows Startup folder initiated by potentially suspicious processes such as WinRAR, unrar, or PowerShell. This behavior is indicative of an attempt to achieve persistence by ensuring the execution of a malicious file upon user login.
Page 701 of 866