Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,550 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects failed attempts to change the system audit policy. This could indicate an adversary attempting to disable or modify security monitoring to evade detection.
This rule detects an unusually high volume of file deletion events on a device within a short time frame (100 or more files deleted within a 5-minute window). This activity can be indicative of malicious behaviors such as ransomware encrypting and deleting original files, data wiping attacks, or an adversary attempting to remove forensic evidence by deleting logs or other critical files.
This rule detects when a single user makes multiple changes to security groups within a short timeframe (binned hourly). Specifically, it looks for Event IDs 4752 (A security-enabled global group was changed), 4753 (A security-enabled local group was changed), or 4754 (A security-enabled universal group was changed). This could indicate an attempt to manipulate group memberships for privilege escalation or lateral movement.
LOLBAS shell32
S1QL
This rule detects the execution of `rundll32.exe` with `shell32.dll` that subsequently launches `cmd.exe`. This behavior is often associated with adversaries using `rundll32.exe` as a proxy to execute commands, specifically leveraging `shell32.dll` to invoke `cmd.exe`. The rule includes several exclusions to reduce false positives, such as legitimate `msiexec.exe` parent processes, specific `RunDLL` commands, and `autorun.bat` related activities.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects when five or more user accounts are deleted within a one-hour period by a single user. This activity can indicate malicious intent to disrupt operations or cover tracks.
This rule identifies potential data exfiltration or unusual data transfer activity by detecting a high volume of large data transfers (over 1MB per transfer) from or to an IIS web server. It aggregates these transfers hourly by client IP and alerts if 10 or more such transfers occur within that hour from a single IP.
This rule detects potential SQL Injection attempts by monitoring IIS web server logs (W3CIISLog) for URI queries containing common SQL keywords such as 'union', 'select', or 'drop'. It aggregates these attempts by client IP address over one-hour intervals and flags any IP address with 5 or more such attempts within that hour.
Detects the use of dsquery.exe to enumerate users in Active Directory. This command-line utility is often used by attackers for reconnaissance to gather information about domain users.
This rule detects potential internal network scanning activity by identifying a single source IP address that communicates with 15 or more distinct internal destination IP addresses within a 5-minute time window. This behavior is often indicative of reconnaissance efforts by an attacker attempting to map out the internal network.
Page 769 of 866