Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,250 copies160 likes55,610 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects the creation of user namespaces on Linux systems by unprivileged users. The 'unshare' command with '--user' or '-U' flags allows a process to move into a new user namespace, which can be abused for privilege escalation or container escape. The rule specifically excludes common container runtimes and processes running as 'root' to reduce false positives.
This rule detects potential container escape attempts on Linux systems by monitoring suspicious file system access patterns to the host's root directory or process creation events involving 'mount', 'nsenter', or 'chroot' commands with parameters indicative of host interaction. Specifically, it looks for file operations on '/proc/1/root', '/proc/1/cwd', '/proc/1/exe', '/proc/1/fd', '/proc/1/ns', '/proc/1/environ', '/proc/1/mounts' or paths starting with '/host', '/hostroot', '/host-root', '/node-root'. It also flags 'mount' commands targeting '/proc/1/root', '/proc/1', 'nsenter', '--target 1', 'hostpath', or '/host', 'nsenter' commands with namespace manipulation arguments, and 'chroot' commands targeting '/proc/1/root', '/host', or '/hostroot'. These activities are commonly associated with adversaries trying to break out of a containerized environment to gain access to the underlying host.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
Detects when Windows Defender's real-time monitoring or anti-spyware features are disabled via registry modification. This can indicate an attempt by an adversary to impair defenses and evade detection.
Detects the use of certutil.exe with command-line arguments indicative of downloading files from a URL or decoding/encoding data. This utility is often abused by adversaries for ingress tool transfer or obfuscation.
Detects potential port scanning activity originating from a Squid proxy server targeting FTP (port 21). This rule identifies instances where a Squid process attempts to connect to port 21 on multiple remote IPs within a one-hour window, which could indicate reconnaissance or malicious activity.
This rule detects potential exploitation attempts related to the 'Squidbleed' vulnerability (CVE-2021-28116) by monitoring 'squid.exe' process command lines for keywords indicative of stack variable overflow exploitation in its FTP parser. Specifically, it looks for the presence of terms like 'stack', 'heap', 'offset', 'buffer', or 'pointer' combined with 'overread', 'overflow', or 'bounds'.
Page 724 of 866