Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,624 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the use of the 'netsh' utility to add 'allow' or 'bypass' rules to the Windows Advanced Firewall. This behavior is frequently used by adversaries to facilitate persistence or lateral movement by opening network ports while bypassing existing security controls.
Detects the execution of known Windows privilege escalation tools (often referred to as 'Potato' exploits) which leverage various Windows service vulnerabilities or print spooler manipulation to escalate user privileges to SYSTEM level.
Detects outbound network connections to well-known public DNS-over-HTTPS (DoH) providers (e.g., Google, Cloudflare, Quad9) from processes other than standard web browsers. This behavior is often associated with adversary attempts to bypass local DNS monitoring or security controls by tunnelled traffic over HTTPS.
This rule monitors for suspicious child processes (like cmd.exe, powershell.exe, wscript.exe, or rundll32.exe) spawned by dllhost.exe. Dllhost.exe is typically a legitimate Windows process for COM object hosting, and it spawning command-line interpreters or administrative utilities is often indicative of malicious activity, such as process injection or lateral movement.
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Detects changes to the attributes of the AdminSDHolder object in Active Directory. The AdminSDHolder object is a template used by the Active Directory security descriptor propagator (SDProp) to enforce permissions on protected administrative groups. Modification of this object is a highly suspicious activity that can be used to establish persistence or grant excessive privileges by poisoning the security descriptors of all protected objects within the domain.
Detects when a single user initiates a high volume (5 or more) of external guest user invitations within a one-hour window. This behavior can be indicative of reconnaissance or attempts to establish persistence by an compromised account by inviting external identities into the tenant.
Detects modifications to Windows Registry keys commonly associated with COM hijacking. Attackers modify these keys to redirect legitimate system calls to malicious executables, achieving persistence and potential privilege escalation. This rule monitors for registry value creation or modification in keys related to shell open commands for MS-settings, MSC files, or executables.
Detects the use of PowerShell commands that modify file system metadata (e.g., CreationTime, LastWriteTime, LastAccessTime). This technique, often referred to as 'timestomping', is used by adversaries to manipulate file timestamps to evade detection or hide activity.
Detects potential Pass-the-Hash lateral movement where a single account uses NTLM authentication as a local administrator to access three or more distinct devices within a 30-minute window, a pattern often indicative of automated credential propagation.
Page 703 of 866