Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,243 copies160 likes55,551 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects potential multi-factor authentication (MFA) bypass attempts for privileged accounts. It identifies instances where an administrative user attempts 10 or more sign-ins from 3 or more unique devices within a 5-minute window, specifically when the authentication method is 'Push notification to app' and the result type is '0' (success). This behavior could indicate an adversary attempting to bypass MFA for a privileged account.
Detects attempts to unload, disable, or remove kernel drivers, which could indicate a rootkit or other malicious activity trying to hide its presence or impair system defenses. The rule specifically looks for process creation events (EventID 4688) where the command line contains keywords related to driver manipulation ('unload driver', 'disable driver', 'remove driver') and also references kernel components ('.sys', 'kernel').
This rule detects suspicious command-line activity indicative of direct kernel object manipulation, often associated with kernel-mode rootkits. It looks for processes executing commands containing keywords related to direct kernel access (e.g., 'directl', 'kernel call', 'ntoskrnl', 'hal.dll') in conjunction with keywords suggesting privilege escalation or driver loading (e.g., 'setprivileges', 'loaddriver', 'createremotethread'). Such combinations can signify attempts to install or interact with malicious kernel drivers or rootkits.
This rule detects multiple attempts (3 or more within an hour) to access critical registry hives (SAM, SYSTEM, SECURITY) with specific access masks (0x0001 - ReadData/ListDirectory or 0x0002 - WriteData/AddFile). This activity can be indicative of credential dumping attempts, particularly targeting the SAM hive to extract local user credentials.
Detects the creation of multiple service principals with administrative or sensitive keywords in their names within a short timeframe, potentially indicating an attempt to establish persistence or escalate privileges in a cloud environment. The rule specifically looks for service principals containing 'admin', 'sync', 'backup', or 'audit' in their display names, created by users outside of Microsoft's internal domains.
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
This rule detects anomalous network connections originating from common communication applications (Teams, Slack, Discord, Skype) to non-standard ports (not 80, 443, 8080, 8443) and to IP addresses not typically associated with Microsoft or other major cloud providers (e.g., not starting with 13. or 51.). It specifically looks for a high volume of such connections (10 or more within an hour) from a single process on a device, which could indicate protocol tunneling or the use of these applications for command and control.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
This rule detects the presence of executables with names commonly associated with legitimate Windows system processes (e.g., system32.exe, winlogon.exe, svchost.exe) but located in non-standard directories outside of 'System32' or 'syswow64'. This behavior is indicative of masquerading, where an attacker attempts to hide malicious executables by naming them after legitimate system processes and placing them in unusual locations to evade detection.
Page 766 of 866