Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,246 copies160 likes55,565 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects suspicious execution patterns involving 'wscript.exe' or 'cscript.exe' that utilize common COM objects or VBScript, while excluding executions from standard Windows and Program Files directories. It specifically looks for multiple unique command line executions within a two-hour window from the same device and account, indicating potential malicious script activity.
This rule detects two types of suspicious process activity. The first part identifies common Windows processes (svchost.exe, explorer.exe, system.exe, services.exe) executing with command lines that suggest driver loading or manipulation (e.g., containing 'driver', '.sys', 'load', 'unsigned', 'disabled UAC'). It flags instances where such activity occurs frequently (5 or more times) within a short timeframe (2 hours) and involves at least one unique driver file. The second part of the rule detects suspicious process termination attempts where specific legitimate Windows processes (MpCmdRun.exe, MsSense.exe, PsExec.exe, rundll32.exe) are observed attempting to terminate critical system processes (svchost.exe, lsass.exe, csrss.exe) multiple times.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
This rule detects a high volume of remote desktop session changes (logon/logoff) for a single user within a one-hour window. Event IDs 4778 and 4779 indicate a session reconnected or disconnected, respectively. A high count (>=10) could suggest suspicious activity such as session hijacking, rapid reconnections by an attacker, or automated tools interacting with remote sessions.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.
This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Looks for generic webshell creation on Windows Servers.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, and regasm.exe when their command line contains suspicious keywords like 'download', 'http', or 'encode'. This activity can indicate an attempt to download malicious payloads or bypass security controls.
Page 761 of 866