Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,249 copies160 likes55,599 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects modifications to Windows Registry Run keys (Run, RunOnce, RunOnceEx, Policies\Run) where the new value contains common scripting interpreters like PowerShell, cmd, cscript, or wscript, and the path is not within the System32 directory. This behavior is indicative of an adversary attempting to establish persistence by ensuring their malicious script or command executes upon user login.
This rule detects suspicious activity related to package managers (nuget, dotnet) where an attempt is made to install or restore packages that are explicitly not marked as 'official' or 'trusted' and contain keywords like '-modified', '-patched', or '-update' in their URL. This could indicate an attempt to inject malicious or tampered dependencies into a project, a common technique in supply chain attacks. The rule triggers if two or more such events occur within an hour on the same computer by the same user.
This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
This rule detects the creation of processes with command-line arguments indicative of 'Playground' ransomware activity. It specifically looks for 'playground', 'pgd-ransom', or 'playground-drop' in the command line of newly created processes (EventID 4688).
This rule detects potential ransomware activity by monitoring Windows Security Event ID 4657 (Registry Value Modified) for specific keywords commonly associated with ransomware notes or demands. It looks for terms like 'ransom', 'payment', 'decrypt', 'unlock', 'bitcoin', and 'monero' within the new value of a modified registry key, specifically within the 'Run' or 'Software' registry paths. This could indicate a ransomware variant attempting to establish persistence or store its ransom note details in the registry.
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
This rule detects the presence of executables with names commonly associated with legitimate Windows system processes (e.g., system32.exe, winlogon.exe, svchost.exe) but located in non-standard directories outside of 'System32' or 'syswow64'. This behavior is indicative of masquerading, where an attacker attempts to hide malicious executables by naming them after legitimate system processes and placing them in unusual locations to evade detection.
This rule detects the creation of processes with command-line arguments indicative of 'Playground' ransomware activity. It specifically looks for 'playground', 'pgd-ransom', or 'playground-drop' in the command line of newly created processes (EventID 4688).
This rule detects successful network connections to remote URLs associated with AlphV/BlackCat ransomware, including payment sites. It specifically looks for 'alphv', 'blackcat', 'noname', or 'ransom-payment' within the RemoteUrl field of DeviceNetworkEvents.
Page 745 of 866