Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,250 copies160 likes55,605 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
Detects the execution of processes with filenames commonly associated with malicious scripts, exploits, or malware. This rule monitors Windows Security Event ID 4688 (process creation) for specific filenames such as 'malware.ps1', 'payload.vbs', 'exploit.js', 'attack.bat', 'backdoor.cmd', 'dropper.exe', 'loader.exe', and 'injector.exe'.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.
This rule detects the execution of 'VmwareSampling.exe' with a command line containing 'victimtoolsalla.dll'. This specific combination is indicative of the NIGHTFORGE loader, which often leverages DLL side-loading techniques to execute malicious payloads. The presence of 'victimtoolsalla.dll' suggests an attempt to load a malicious DLL via a legitimate VMware process.
This rule detects potential DLL sideloading activity by monitoring process creation events where specific executables ("Setup_File_75.593.2113.exe" or "SystemSettings.exe") are launched with a command line containing "borlndmm.dll". It then correlates this with file events to confirm the presence of "borlndmm.dll" on the same device. This pattern is indicative of the OnyxC2 malware attempting to load a malicious DLL.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
Detects instances where an unsigned or non-trusted process attempts to access the memory of the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by threat actors to harvest credentials for lateral movement and privilege escalation.
Detects the use of native Windows utilities (vssadmin.exe, wbadmin.exe, bcdedit.exe, and diskshadow.exe) to delete volume shadow copies, clear backup catalogs, or modify boot configuration to inhibit system recovery, a common behavior observed in ransomware attacks.
Page 727 of 866