Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,250 copies160 likes55,611 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
This rule detects the execution of 'eventviewer.exe' by scripting engines such as 'wscript.exe', 'cscript.exe', or 'vbscript.exe'. This behavior is indicative of a User Account Control (UAC) bypass technique where 'eventviewer.exe' is abused to elevate privileges without user interaction.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
Detects the execution of Windows script files (JS, VBS, HTA) using wscript.exe or cscript.exe from common staging areas like AppData, Temp, or ProgramData, specifically when the initiating process is not a signed Microsoft binary. This pattern is highly indicative of potential malicious script execution often used in phishing delivery or secondary payload stages.
Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
This rule detects potential DLL sideloading by identifying signed executables that load unsigned DLLs from user-writable directories, such as Temp, AppData, Downloads, or Documents. It excludes loads from standard, protected Windows directories to reduce noise.
Detects WMI persistence mechanisms by monitoring for suspicious child process spawning from WMI host processes (scrcons.exe, wbemcons.exe), unauthorized loading of MOF files via mofcomp.exe, and execution of common living-off-the-land binaries directly by the WMI provider host (wmiprvse.exe).
Detects the use of the WMIC.exe utility to execute processes on remote systems using the 'process call create' command. This technique is commonly used by adversaries for lateral movement. The rule excludes local execution scenarios.
Page 720 of 866