Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,246 copies160 likes55,565 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
This rule detects an unusual number of local or remote interactive logons (LogonType 2 or 10) by the 'SYSTEM' account within a one-hour window. While the SYSTEM account is legitimate, direct interactive logons are rare and multiple occurrences could indicate an attempt to escalate privileges or maintain persistence by an attacker.
This rule detects potential process hollowing or process blanketing attempts by monitoring Windows Security Event ID 4688 (A new process has been created) and checking if the command line contains the strings 'ProcessHollowing' or 'ProcessBlanketing'. These strings in the command line of a newly created process could indicate an attempt to inject malicious code into a legitimate process to evade detection.
This rule detects the creation of new processes (EventID 4688) where the command line contains keywords commonly associated with User Account Control (UAC) bypass techniques, such as 'uac', 'UAC', or 'bypassuac'. This could indicate an attempt to elevate privileges without user consent.
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
Detects execution of installers for Binance, Bybit, MEXC, MetaTrader 5, or Exodus wallets loading CRYPTBASE.dll, linked to credential theft campaigns.
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
This rule detects the execution of potentially unwanted programs (PUPs) from common temporary or user-specific download directories. It specifically looks for processes with filenames indicative of PUPs (e.g., 'pua.exe', 'adware.exe', 'pup.exe', 'unwanted.exe') originating from 'Temp', 'AppData', or 'Downloads' folders. The rule aggregates these events per device per hour and alerts if one or more such executions occur, indicating potential user-initiated installation or drive-by download of unwanted software.
Page 764 of 866