Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,250 copies160 likes55,603 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
This rule detects command-line activity indicative of encryption key extraction or dumping. It looks for specific keywords like 'dumpkey', 'exportkey', 'savekey', 'keystore', and 'privkey' in the command line of processes such as 'servertool.exe', 'encrypt.exe', 'powershell.exe', and 'cmd.exe'. This activity is often associated with ransomware or other malicious software attempting to exfiltrate cryptographic keys.
This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.
This rule detects attempts to bypass User Account Control (UAC) using specific Windows executables (eventviewer.exe, fodhelper.exe, computerdefaults.exe, slui.exe) initiated by cmd.exe or powershell.exe. The rule specifically looks for these executables being run from non-standard system directories, indicating a potential UAC bypass technique often observed after an initial compromise, such as via RDP.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
Detects command-line activity indicative of timestomping, specifically when 'cmd.exe' is used with file copy/move commands ('copy', 'xcopy', 'robocopy', 'move') and the target path is not within 'Program Files' or 'Windows' directories. This behavior is often associated with ransomware like Prinz Eugen attempting to hide its activities.
This rule detects potential Prinz Eugen ransomware activity by identifying instances where drive letter enumeration commands (wmic.exe logicaldisk, fsutil.exe fsinfo, diskpart.exe) are executed, followed within 30 minutes by the execution of known ransomware executables (servertool.exe, encrypt.exe) on the same device. This sequence of events suggests reconnaissance prior to data encryption.
This rule detects network connections to remote URLs containing specific keywords ('festung', 'germania', 'deutsch', 'prinz', 'eugen') that are indicative of Germany-themed infrastructure potentially associated with the Prinz Eugen Ransomware. This helps identify early communication with command and control servers or data exfiltration points.
This rule detects process execution where the command line contains keywords indicative of inline assembly or native code injection (e.g., 'shellcode', 'payload', 'bytecode', 'native', 'runtime') and the process is one of several common executables ('servertool.exe', 'encrypt.exe', 'powershell.exe', 'cmd.exe'). This behavior is often associated with malware, including ransomware, attempting to execute malicious code.
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
Page 735 of 866