Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,618 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
Detects command-line activity containing keywords related to API hooking (e.g., SetWindowsHookEx, hook, inline, trampoline) initiated by common scripting interpreters like powershell.exe, cmd.exe, or rundll32.exe. This pattern is often associated with malware attempting to inject code or capture data by intercepting process function calls.
Detects the use of common PowerShell cmdlets often associated with fileless malware execution, such as 'Invoke-Expression', 'IEX', or 'DownloadString', initiated by 'powershell.exe'. These patterns are frequently used to download and execute malicious payloads directly in memory, bypassing traditional disk-based scanning.
This rule detects process execution where the command line arguments contain keywords commonly associated with memory corruption and exploitation (e.g., shellcode, buffer overflow, heap/stack manipulation). The rule further filters for small executable files (less than 100KB) to increase the likelihood of identifying malicious tools or stagers.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
Detects command lines that reference known supply chain attack targets or commonly used package management tools like npm and pypi, which can be indicators of supply chain compromise.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Detects command-line execution containing keywords associated with Guloader (e.g., 'guloader', 'gupl') or generic download indicators (e.g., 'download' combined with protocol identifiers like 'http', 'https', 'ftp'). This typically indicates the malicious downloading of payloads by the Guloader malware family.
Detects process executions containing sensitive keywords related to trust, certificates, and multi-factor authentication (e.g., 'mfa', '2fa', 'otp') that are not initiated by standard trusted system processes (services.exe, wininit.exe, smss.exe). This pattern is often indicative of credential manipulation, certificate harvesting, or tampering with authentication mechanisms.
Page 713 of 866