Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,246 copies160 likes55,580 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects suspicious command execution activity originating from RemotePC applications. It identifies instances where 'IDriveRemotePC.exe', 'RemotePC.exe', or 'IDrive.exe' are used to execute commands containing keywords like 'exec', 'execute', 'run', 'invoke', or 'call' at a high frequency (5 or more commands within an hour). This behavior could indicate an adversary using legitimate remote access software for malicious purposes, such as lateral movement or further compromise.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
This rule detects process execution where the command line contains keywords indicative of inline assembly or native code injection (e.g., 'shellcode', 'payload', 'bytecode', 'native', 'runtime') and the process is one of several common executables ('servertool.exe', 'encrypt.exe', 'powershell.exe', 'cmd.exe'). This behavior is often associated with malware, including ransomware, attempting to execute malicious code.
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
Detects the creation or modification of registry run keys that establish persistence for the Prinz Eugen ransomware. The rule specifically looks for registry entries under 'Software\Microsoft\Windows\CurrentVersion\Run' that contain common environment variables (e.g., %APPDATA%, %TEMP%) and specific filenames or paths associated with Prinz Eugen ransomware (e.g., 'servertool', 'encrypt.exe', '\Music\', '\Desktop\').
This rule detects the execution of processes named 'servertool.exe' or 'encrypt.exe' that are likely associated with the Prinz Eugen ransomware. The detection logic specifically looks for these executables being run with command-line arguments indicative of multi-threaded or parallel processing, such as 'goroutine', 'threads', 'workers', or 'parallel'. It then counts the number of unique process IDs for these activities within a 5-minute window on a given device and flags if four or more such processes are observed, suggesting a high-intensity encryption operation.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
KQL Query from file: identity_privilege_escalation_june2026.kql
Detects potential credential access attempts indicative of infostealer activity or brute-force attacks, where an account experiences multiple failed login attempts followed by a successful login within a defined timeframe (5 minutes to 8 hours). This pattern suggests an adversary may be using stolen credentials or attempting to brute-force an account.
Page 756 of 866