Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,624 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects modifications to the Windows Defender exclusion list via registry keys. Adding exclusions can be used by attackers to hide malicious files, processes, or directories from antivirus scanning.
Detects successful user sign-ins from a country that has not been observed in the user's sign-in activity over the past 30 days. This baseline helps identify potentially compromised accounts by surfacing geographic anomalies.
Detects the clearing of Windows Security and System event logs, or Defender XDR audit logs, indicating potential adversary activity to remove traces of their actions.
Detects the spawning of suspicious child processes such as PowerShell, cmd, or rundll32 from common productivity applications like Microsoft Office or PDF readers. This pattern is often indicative of macro-based execution, malicious document payloads, or living-off-the-land techniques used to initiate secondary stages of an attack.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell sessions by monitoring for common indicators such as manual manipulation of AmsiUtils, AmsiScanBuffer, or reflection-based patching techniques. This activity is indicative of an adversary attempting to execute malicious code without security interference.
Detects modifications to Windows Registry keys associated with Image File Execution Options (IFEO) or Silent Process Exit, which are techniques commonly abused by adversaries to hijack execution flow for persistence or privilege escalation. The rule monitors for the creation or modification of 'Debugger', 'GlobalFlag', 'MonitorProcess', or 'ReportingMode' values, excluding known legitimate debuggers.
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
Detects the use of regsvr32.exe to execute remote scripts or components via a URL (a technique often referred to as Squiblydoo). This rule flags process command lines containing /i flags combined with remote HTTP/HTTPS addresses, while excluding known management tools to reduce false positives.
Detects modifications to Windows Registry keys associated with Image File Execution Options (IFEO) or Silent Process Exit, which are techniques commonly abused by adversaries to hijack execution flow for persistence or privilege escalation. The rule monitors for the creation or modification of 'Debugger', 'GlobalFlag', 'MonitorProcess', or 'ReportingMode' values, excluding known legitimate debuggers.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Page 704 of 866