Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,250 copies160 likes55,606 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects when common document-handling applications (such as Microsoft Office suite or PDF readers) spawn known remote access and support tools. This behavior is highly indicative of vishing-based social engineering attacks, where a user is tricked into downloading and executing a remote management tool via a malicious document.
Detects the execution of mshta.exe when invoked with command-line arguments indicative of script execution (e.g., vbscript:, javascript:, http(s)://) or when spawned by common Microsoft Office applications. This behavior is frequently associated with malicious document-based attacks, where office macros trigger mshta to download or execute obfuscated code.
Detects instances where non-browser processes attempt to open a handle to common web browsers (Chrome, Edge, Firefox). This behavior is indicative of unauthorized memory access or process injection techniques often used to harvest session cookies or other sensitive data stored in browser memory space.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects the use of common Windows system administration tools (cmd, powershell, net, sc, taskkill, wmic) to stop, delete, or terminate known backup software agents. This behavior is highly characteristic of ransomware or destructive attacks attempting to inhibit system recovery by destroying backup infrastructure.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
Detects suspicious execution patterns (such as encoded commands, downloading files via web clients, or using administration utilities) originating from third-party update, monitoring, or deployment agents. This behavior is indicative of a supply chain compromise or malicious activity leveraging trusted binaries to execute arbitrary code.
Detects instances where common Windows processes (svchost.exe, explorer.exe, or notepad.exe) spawn suspicious child processes (such as cmd.exe, powershell.exe, or wscript.exe). The rule identifies potential process hollowing or living-off-the-land techniques by correlating parent-child relationships with suspicious command-line parameters (encoding, hidden execution, or in-memory execution) or anomalous file paths (running from user-writable directories).
Detects non-browser processes initiating HTTPS network connections to well-known public DNS over HTTPS (DoH) resolvers. This behavior is often associated with command and control (C2) communication, where malware attempts to evade network security controls by tunneling DNS queries through encrypted HTTPS traffic.
Page 728 of 866