Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,612 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the execution of 'cmd.exe' with a command line that includes 'ping 127.0.0.1' combined with a file deletion command ('del', 'delete', 'erase'). This pattern is often used by malware, such as ransomware, to introduce a delay before self-deletion or to ensure network connectivity before performing destructive actions, followed by an attempt to remove its traces.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
Detects suspicious installations of ManageEngine Endpoint Central components (ManageEngineADSelfService.exe or me_servicelaunchpad.exe) when executed with silent installation parameters or initiated by scripting engines (wscript.exe, cscript.exe, powershell.exe), followed by the execution of 'reg.exe' or 'regsvcs.exe' within a two-hour window. This pattern can indicate an attempt to install or configure the software surreptitiously, potentially for persistence or privilege escalation.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) where the initiating parent process is not a common legitimate process like explorer.exe, cmd.exe, powershell.exe, svchost.exe, or system.exe, and is also not a web browser (Chrome or Firefox). This pattern can indicate an attempt to execute malicious VBScript or JScript files, potentially delivered via phishing, where the script is launched by an unusual or obfuscated parent process to evade detection.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
Page 719 of 866