Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,612 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects network connections to known command and control (C2) infrastructure associated with the 'Prinz Eugen' ransomware, also referred to as the ROOTBOY actor. It identifies connections to specific IP addresses and URLs that have been linked to this threat actor's operations.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.
This rule detects attempts to load kernel drivers using command-line utilities such as infinstall.exe, devcon.exe, pnputil.exe, or sc.exe. The detection specifically looks for these commands being initiated by powershell.exe, cmd.exe, or ServertoolLauncher.exe, which could indicate malicious activity like ransomware attempting to establish persistence or evade defenses.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
Detects the execution of executable files (.exe) within a user's 'Music' folder, which is an unusual location for legitimate program execution. This activity is often associated with ransomware, such as Prinz Eugen, attempting to encrypt user files. The rule excludes executions initiated by common archive utilities (explorer.exe, winrar.exe, 7z.exe) to reduce false positives.
Detects the execution of known ransomware-related executables ('servertool.exe', 'encrypt.exe') when their command line arguments indicate interaction with cloud storage services such as OneDrive, SharePoint, GoogleDrive, Dropbox, or iCloud. This behavior is indicative of ransomware attempting to encrypt or exfiltrate data from cloud environments.
Detects potential credential dumping activity where ManageEngine ADSelfService processes initiate other processes commonly associated with credential dumping, such as taskmgr.exe, lsass.exe, winlogon.exe, or wlrmdr.exe. This behavior could indicate an adversary attempting to extract credentials.
This rule detects suspicious DNS queries originating from VBScript (wscript.exe or cscript.exe) processes. It specifically filters out common legitimate domains like Microsoft, Windows, and Google to reduce noise, aiming to identify potential phishing or malware activity leveraging VBScript for network communication.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Page 718 of 866