Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,249 copies160 likes55,599 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the creation of specific suspicious files (result.dll, KKN, ND8) in the C:\ProgramData directory, immediately followed by a network connection to known malicious IP addresses. This pattern is indicative of malware dropping and subsequent command and control communication.
Detects the execution of VBScript or JScript files (via wscript.exe or cscript.exe) where the command line contains common VBScript argument handling keywords. This pattern can indicate malicious script execution attempting to parse arguments for further actions, potentially as part of a phishing attack or malware execution chain.
This rule detects suspicious administrative activities in Azure AD, Microsoft Graph, SharePoint, Exchange, or Teams when performed by accounts that are not explicitly identified as 'admin' or 'service' accounts. It looks for a combination of at least 5 operations and 2 unique operation types within a 2-hour window, targeting group, application, or service principal related resources. This could indicate an attacker using compromised non-privileged accounts to perform administrative actions or escalate privileges.
This rule detects the execution or file interaction of known local AI/Large Language Model tools (e.g., Ollama, LM Studio, GPT4All) when initiated by non-interactive system processes (such as services.exe, svchost.exe, or lsass.exe) or under system/network service account contexts. This behavior is indicative of unauthorized local model staging or enumeration within a compromised environment.
This rule detects the execution or file interaction of known local AI/Large Language Model tools (e.g., Ollama, LM Studio, GPT4All) when initiated by non-interactive system processes (such as services.exe, svchost.exe, or lsass.exe) or under system/network service account contexts. This behavior is indicative of unauthorized local model staging or enumeration within a compromised environment.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
This rule detects the execution of 'cmd.exe' with command-line arguments indicative of file deletion, specifically targeting files or directories commonly associated with ransomware activity or anti-forensics. The rule looks for deletion commands ('del', 'erase', 'remove', 'delete') combined with specific file paths or executables ('servertool.exe', 'encrypt.exe', 'Music\', 'Desktop\'). This behavior is often observed in ransomware attacks to remove traces or critical files.
This rule detects suspicious loading of common DLLs (mshtml.dll, mscoree.dll, clr.dll, kernel32.dll, advapi32.dll) by VBScript interpreters (wscript.exe or cscript.exe). This activity can be indicative of phishing attacks or malicious script execution attempting to interact with system components or the .NET framework.
Detects the execution of RegSvcs.exe initiated by a VBScript (wscript.exe or cscript.exe). This technique can be used by adversaries to bypass application control and execute malicious code.
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
Page 737 of 866