Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,550 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
This rule detects modifications to registry keys (EventID 4657) where the new value contains strings commonly associated with Command and Control (C2) configurations, such as 'C2', 'beacon', 'callback', 'command_server', 'c2_ip', or 'control_server'. This could indicate an adversary establishing or modifying C2 communication channels via the registry.
This rule detects attempts to modify registry keys related to proxy settings, specifically 'ProxyOverride', 'ProxyServer', or 'NoProxy', to include local bypass addresses such as 'localhost', '127.0.0.1', or '<local>'. This activity could indicate an adversary attempting to bypass network proxies for command and control or data exfiltration.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
This rule detects potential Trickbot malware command and control (C2) communication by identifying network connections to specific remote URLs and ports commonly associated with Trickbot activity. It looks for multiple connections within an hour from the same device to these indicators.
Detects files with suspicious double extensions (e.g., .exe.txt, .dll.txt) or .scr extension, which can indicate an attempt to masquerade malicious executables or scripts as benign text files or screensavers. The rule excludes files in the System32 directory to reduce false positives.
This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.
This rule detects the creation or renaming of files with specific names associated with Deimos ransomware, including '.deimos', '.payment_id', or 'deimos_note'. These file names are commonly used by Deimos ransomware for encrypted files or ransom notes.
Detects the creation of processes with command-line arguments containing keywords associated with Conti ransomware, such as 'conti', 'conti-drop', or 'conti-payload'. This rule monitors Windows Security Event ID 4688, which logs process creation.
This rule detects modifications to specific registry keys that are commonly used for persistence by malware. The rule looks for Event ID 4657 (A registry value was modified) and checks if the ObjectName corresponds to known malicious registry paths related to Run keys, RunOnce, or service configurations. This indicates an attempt to establish persistence or alter system behavior for malicious purposes.
Page 767 of 866