Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,246 copies160 likes55,591 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
This rule detects repeated failed or successful logon attempts (EventID 4625 or 4624) to sensitive system accounts like 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', or 'ADMIN$' from non-system accounts. It specifically looks for interactive (LogonType 10), remote interactive (LogonType 3), or unlock (LogonType 9) logons, and triggers if there are 3 or more such attempts within an hour for the same account and computer.
This rule detects suspicious command-line activity related to Duo Security administration. It looks for processes executing with 'duo_client', 'duo_admin', or 'duo_api' in their command line, combined with sensitive parameters like '--admin-api', '--key', '--secret', or 'token'. The rule specifically excludes processes spawned by 'powershell.exe' or 'cmd.exe' to reduce noise, and triggers if such activity occurs at least twice within an hour on the same computer by the same user. This could indicate an attempt to manipulate Duo Security configurations, potentially to bypass multi-factor authentication.
This rule detects potential credential harvesting attempts by identifying a high volume of short-duration HTTP requests to common login, sign-in, verify, account, or authentication URI stems. It specifically looks for requests originating from user agents commonly associated with bots or scripting tools (e.g., 'bot', 'curl', 'python', 'powershell') and successful HTTP status codes (200). The 'short' session duration is inferred from small response sizes (less than 5000 bytes), suggesting automated access rather than human interaction.
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
This rule detects attempts to extract authorization headers (Bearer, Basic, or X-API-Key) over FTP (port 21) by inspecting network signatures. This could indicate an attempt to exploit a vulnerability or misconfiguration where sensitive credentials are being transmitted in an insecure manner.
Detects the execution of 'squid.exe' with command-line arguments that contain whitespace characters potentially indicative of a NULL terminator vulnerability (Squidbleed). The rule specifically looks for common whitespace representations like 'w_space', 'space', 'tab', 'newline', '\n', '\r', and '\t' in the command line.
Detects outbound network connections from 'squid.exe' to internal IP addresses on port 21 (FTP). This could indicate an attacker controlling an FTP server within the internal network, potentially exploiting a vulnerability like Squidbleed.
This rule detects potential exploitation attempts related to the Squidbleed vulnerability, specifically looking for the execution of 'squid.exe' with command-line arguments indicative of a 'while loop bypass via null terminator manipulation'. The keywords 'while', '++copyFrom', 'strchr', and 'w_space' are used to identify suspicious command-line activity.
This rule detects when the 'squid.exe' process is executed with command-line arguments indicating a configuration reload, restart, or explicit use of 'squid.conf'. This could be indicative of an attacker manipulating Squid proxy settings, potentially as part of the Squidbleed vulnerability exploitation or other malicious activity.
Page 749 of 866