Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,612 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the use of command-line arguments associated with Windows token impersonation techniques (e.g., 'SeImpersonate', 'ImpersonateLoggedOnUser') initiated by common command-line interpreters (powershell.exe, cmd.exe, wmic.exe). This activity is often indicative of an adversary attempting to elevate privileges by stealing or manipulating access tokens.
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Detects the execution of processes with command line arguments containing terms related to quantum-resistant or post-quantum cryptography (e.g., lattice, isogeny, multivariate, hash). This is intended to identify the usage of specific cryptographic libraries or tools that may be relevant for advanced adversaries researching post-quantum decryption techniques or securing their own communications against future quantum-enabled decryption.
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
Detects the execution of executable files with suspicious command line arguments related to AI or Machine Learning frameworks (e.g., tensorflow, pytorch, neural) where the file size is relatively small (between 50KB and 500KB), which may indicate potentially malicious payloads masquerading as legitimate AI utilities.
This rule detects the execution of the squid.exe process where the command line does not explicitly specify a configuration file using the '-f' or '-n' flags, nor does it reference 'squid.conf'. Running Squid without a defined configuration file may lead to the application loading default, insecure, or unintended settings, which could be exploited as part of a vulnerability chain or misconfiguration.
This rule detects the creation or manipulation of mutexes by processes that contain keywords associated with the Remcos RAT (Remote Access Trojan). Specifically, it looks for command-line arguments containing "Remcos_Mutex_Inj", "Remcos_Mutex", "mutex", or "CreateMutex". This activity can indicate the presence or execution of Remcos RAT on a system, as mutexes are often used by malware for single-instance enforcement or inter-process communication.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
This rule detects suspicious process command lines that indicate the extraction of steganographically hidden payloads, potentially associated with the Remcos RAT. It specifically looks for processes with 'GST' in their name or initiating process file name, combined with keywords related to bitmap or image resource manipulation in the command line.
Page 716 of 866