Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,621 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects when Windows Defender's real-time monitoring or anti-spyware features are disabled via registry modification. This can indicate an attempt by an adversary to impair defenses and evade detection.
This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.
This rule detects the creation, modification, or renaming of the `authorized_keys` file within the `.ssh` directory by processes other than common SSH key management or shell utilities. This activity could indicate an adversary attempting to establish persistence or elevate privileges by adding their own public key for SSH access.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
Detects suspicious Python process execution that combines network socket creation with memory manipulation imports (ctypes/mmap) or shellcode-like hex byte strings in the command line. This behavior is indicative of in-memory exploit delivery or staging, often used by adversaries to execute malicious code without writing it to disk. The rule also looks for inline Python execution (-c) with similar indicators.
This rule detects various methods of establishing a reverse shell on Linux systems. It looks for process creation events involving common shell interpreters (bash, sh) attempting to connect to network devices via /dev/tcp or /dev/udp. It also identifies the use of network utilities like netcat (nc, ncat, netcat, nc.traditional) and socat when used with command execution flags (-e, -c, EXEC) and shell interpreters. Additionally, it flags direct outbound network connections initiated by these shell interpreters or network utilities, which could indicate a reverse shell communication channel.
This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.
Detects attempts to open the Local Security Authority Subsystem Service (LSASS) process with read permissions (specifically, PROCESS_VM_READ access) by non-system processes. This activity is often associated with credential dumping techniques.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
Page 710 of 866