Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,249 copies160 likes55,599 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
Detects potential Trickbot activity by searching for known Trickbot-related keywords ('trickbot', 'server=', 'botnet', 'moduleload') in process command lines, combined with network-related keywords ('http', 'port'). This rule specifically looks for Event ID 4688 (a process creation event in Windows Security Event Logs) and analyzes its CommandLine field.
This rule detects potential process injection attempts by monitoring Windows Security Event ID 4688 (A new process has been created) for specific keywords in the command line. The keywords 'CreateRemoteThread', 'WriteProcessMemory', 'VirtualAllocEx', 'SetWindowsHookEx', and 'LoadLibrary' are commonly associated with various process injection techniques. The rule summarizes these attempts by computer, user, and hourly intervals.
Detects files with suspicious double extensions (e.g., .exe.txt, .dll.txt) or .scr extension, which can indicate an attempt to masquerade malicious executables or scripts as benign text files or screensavers. The rule excludes files in the System32 directory to reduce false positives.
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
Detects the creation of processes with command-line arguments containing keywords associated with Conti ransomware, such as 'conti', 'conti-drop', or 'conti-payload'. This rule monitors Windows Security Event ID 4688, which logs process creation.
This rule detects processes making three or more successful outbound network connections within an hour to known code or text sharing sites like Pastebin, GitHub, or Gist. This activity can be indicative of data exfiltration, command and control (C2) communication, or staging of malicious code.
This rule detects the creation of suspicious files, specifically .lnk files or files containing 'JUNCTION' in their name, within the 'AppData\Local\Temp' directory. It further refines the detection to look for paths that contain '..\', indicating a recursive or unusual directory structure, which can be used to hide malware or evade detection.
Detects the use of legitimate administrative tools (regsvcs.exe, infinstall.exe, devcon.exe) being executed with command-line arguments indicative of driver or kernel-level installations (e.g., 'kernel', 'ring0', 'driver install'). This behavior is commonly associated with the installation of rootkits or the execution of Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode privileges.
Detects the creation of a Windows service using administrative tools (sc.exe or net.exe) followed closely by an instruction to start that service within a 5-minute window. This behavior is often associated with the execution of malicious payloads or lateral movement.
Page 740 of 866