Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,249 copies160 likes55,599 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects the execution of the squid.exe process where the command line does not explicitly specify a configuration file using the '-f' or '-n' flags, nor does it reference 'squid.conf'. Running Squid without a defined configuration file may lead to the application loading default, insecure, or unintended settings, which could be exploited as part of a vulnerability chain or misconfiguration.
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
Detects a sequence of events where ManageEngine or IDrive remote monitoring software is followed within 120 minutes by the execution of potential staging or encryption-related tools (servertool.exe or encrypt.exe) on the same device. This pattern may indicate the abuse of legitimate administrative tools for unauthorized activities or ransomware-like behavior.
This rule detects the usage of standard Windows system administration utilities (infinstall.exe, devcon.exe, pnputil.exe, sc.exe) when the command line arguments include keywords commonly associated with driver loading or kernel-level operations, which may indicate the installation of a rootkit or malicious driver.
Detects the execution of major web browsers (Chrome, Firefox, Internet Explorer) with command line arguments containing keywords related to browser extensions, addons, or plugins. This pattern is often used to load unauthorized or malicious extensions for persistence or browser hijacking.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
This rule detects successful sign-ins using OAuth from residential IP addresses. It joins `SigninLogs` with `IdentityLogonEvents` to correlate successful OAuth authentications with user logon events. The intent is to identify potentially suspicious access, possibly indicating credential abuse or unauthorized access attempts from non-corporate or unexpected locations.
This rule detects queries made within ServiceNow by accounts classified as 'Guest' or 'Unknown'. This could indicate unauthorized access or unusual activity from unprivileged or unidentifiable accounts attempting to query data within the ServiceNow environment.
This rule detects potential exploitation attempts targeting REDCap, specifically looking for file events involving 'help.php' or 'Upgrade.php', or network events where the remote URL contains 'REDCAP-TOKEN'. These indicators suggest an attacker might be trying to exploit known vulnerabilities or exfiltrate data from a REDCap instance.
Page 743 of 866