Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,243 copies160 likes55,551 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects when two or more files with suspicious names (e.g., 'update.exe', 'temp.exe', 'setup.exe') are created within a short timeframe (1 hour) in common user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. This pattern can indicate the dropping of malicious payloads or staging of files by an adversary.
This rule detects potential ransomware activity by monitoring Windows Security Event ID 4657 (Registry Value Modified) for specific keywords commonly associated with ransomware notes or demands. It looks for terms like 'ransom', 'payment', 'decrypt', 'unlock', 'bitcoin', and 'monero' within the new value of a modified registry key, specifically within the 'Run' or 'Software' registry paths. This could indicate a ransomware variant attempting to establish persistence or store its ransom note details in the registry.
This rule detects attempts to modify registry keys related to proxy settings, specifically 'ProxyOverride', 'ProxyServer', or 'NoProxy', to include local bypass addresses such as 'localhost', '127.0.0.1', or '<local>'. This activity could indicate an adversary attempting to bypass network proxies for command and control or data exfiltration.
This rule detects the creation of processes with specific, known malicious hashes (identified as 'ProcessId' in the rule logic, but likely representing image hashes). It monitors Windows Security Event Log (EventID 4688) for process creation events and triggers when a process's identifier matches one of the predefined indicators of compromise (IOCs). This indicates the execution of a known Trojan or other malicious software.
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
This rule detects high volume data exfiltration (over 1GB) from devices to a list of known malicious IP addresses within a one-hour window. It specifically looks for network events where a significant amount of data (SentBytes > 100MB initially, then summed to over 1GB) is sent to hardcoded remote IP addresses associated with potential command and control or data exfiltration infrastructure.
This rule detects potential indicators of AI-powered adversarial attacks by monitoring process creation events (EventID 4688) for command lines containing keywords related to popular machine learning frameworks (TensorFlow, PyTorch, Keras) combined with terms like 'model', 'neural', or 'train'. A high count (2 or more) of such events within an hour on a single computer and account triggers an alert, suggesting the execution of AI/ML-related code that could be part of an adversarial attack or research.
Detects the execution of cmstp.exe with the '/s' flag, which indicates a silent installation. This behavior is often abused by adversaries to proxy execution of malicious code, bypass application control, or bypass User Account Control (UAC).
Monitors for systems communicating with trycloudflare.com infrastructure, which may indicate creation or use of temporary Cloudflare tunnels capable of bypassing traditional remote access controls.
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Page 768 of 866