Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,249 copies160 likes55,599 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects suspicious command-line activity that may indicate the leakage of API keys, specifically those resembling OpenAI API keys (starting with 'sk-', 'sk_live_', or 'sk_test_'). It looks for these patterns in conjunction with common data transfer utilities like curl, wget, powershell, or python, when executed by a process that is not a standard shell or explorer process. The rule triggers if two or more such events occur within an hour on the same computer.
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
This rule detects modifications to critical boot sector files (bootsect, bootmgr, BOOTCODE, MBR) on the C: or X: drives. It specifically looks for these modifications when initiated by processes other than common system processes like 'system', 'csrss.exe', or 'explorer.exe'. The rule counts modifications within one-hour bins and triggers if one or more modifications are observed.
Detects multiple instances of a non-SYSTEM or non-LOCAL SERVICE account using 'RunAs' to execute processes as highly privileged accounts (admin, system, root) within a short timeframe. This could indicate an attempt at privilege escalation or token impersonation.
This rule detects attempts to access or dump the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which can contain sensitive credential information. It specifically looks for Security Event ID 4656 (handle to an object was requested) where the target object is 'lsass.exe', 'lsass.bin', or 'ntds.dit', with specific access masks ('0x1fffff' or '0x1410'), and excludes common system accounts. A high count of such access attempts within an hour from a non-system user triggers the alert.
This rule detects suspicious process activity indicative of process injection, specifically looking for the creation of remote threads combined with memory allocation, writing to process memory, and loading of DLLs. It monitors Security Event ID 4688 (a process creation event) and filters for command-line arguments containing functions commonly used in process injection techniques such as 'CreateRemoteThread', 'VirtualAllocEx', 'WriteProcessMemory', 'GetProcAddress', and references to '.dll' or 'LoadLibrary'. A count of such events within an hour is then used to identify potential injection attempts.
Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
Page 739 of 866