Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,621 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the execution of the 'unshare' utility with arguments that create new user, network, and mount namespaces (-U, -n, -r) by a non-root user. This technique is often used to bypass namespace restrictions or perform privilege escalation by gaining elevated capabilities within a new, user-controlled namespace.
Detects potential browser fingerprinting and network reconnaissance behavior associated with Bluekit BitM PhaaS campaigns. The rule correlates large suspicious JavaScript file downloads (excluding common CDNs) with STUN server connectivity within a 10-minute window, a pattern often used by adversary-in-the-middle (AiTM) frameworks to fingerprint victims and establish WebRTC channels.
This rule detects suspicious WebSocket upgrade attempts targeted at Microsoft authentication endpoints, typically used by 'Bluekit' or similar Phishing-as-a-Service (PhaaS) platforms to establish a persistent connection or tunnel for credential harvesting via adversary-in-the-middle attacks. It flags traffic from non-private IP addresses that exhibit specific patterns associated with proxy usage or automated tooling (e.g., Python/curl) combined with WebSocket upgrade headers.
Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.
Detects Active Directory object access events (Event ID 4662) associated with domain controller replication rights (Replication-Get-Changes or Replication-Get-Changes-All). This behavior is often associated with credential dumping techniques like DCSync, where an attacker impersonates a domain controller to request replication of sensitive data, such as password hashes, from another domain controller.
Detects modifications to domain trust relationships, such as the creation of a new trust, removal of an existing trust, or changes to trusted domain information. Such events are monitored as they can indicate an adversary attempting to elevate privileges or establish persistence across a forest or multi-domain environment.
Detects Active Directory object access events (Event ID 4662) associated with domain controller replication rights (Replication-Get-Changes or Replication-Get-Changes-All). This behavior is often associated with credential dumping techniques like DCSync, where an attacker impersonates a domain controller to request replication of sensitive data, such as password hashes, from another domain controller.
Detects the execution of known Windows privilege escalation tools (often referred to as 'Potato' exploits) which leverage various Windows service vulnerabilities or print spooler manipulation to escalate user privileges to SYSTEM level.
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Detects successful OAuth application consent events where the requested permissions include sensitive scopes such as Mail, Files, or User profile access. This is a common indicator of OAuth application-based phishing or persistence attempts, often referred to as 'Illicit Consent Grant' attacks.
Page 702 of 866