Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,618 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
This rule detects potential lateral movement activity by identifying devices that establish connections to three or more distinct remote IP addresses via SMB/CIFS ports (445 or 139) within a one-hour window. The query excludes internal network ranges (10.x.x.x and 192.168.x.x) to focus on connections that may be traversing network boundaries or reaching out to segments that might indicate unauthorized discovery or movement.
This rule detects the use of wmic.exe to execute commands or manage remote systems, specifically flagging indicators of lateral movement, credential usage, or command execution like 'node', 'user', 'password', and 'call create'.
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, cipher) to delete Volume Shadow Copies or modify boot/recovery configurations, which is a common behavior used by ransomware and attackers to inhibit system recovery.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
Detects the spawning of core Windows system processes (explorer.exe, svchost.exe, lsass.exe, winlogon.exe) by common script interpreters (powershell.exe, cmd.exe, wscript.exe). This pattern is often indicative of malicious activity, such as process hollowing, privilege escalation, or persistence mechanisms where an adversary abuses these interpreters to initiate or inject into critical system processes.
Page 714 of 866