Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,549 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
This rule detects when a single caller performs multiple (3 or more) retrievals of Azure Storage Account Keys within a one-hour window. This activity can indicate an attempt to gain unauthorized access to storage resources or exfiltrate data.
This rule detects when multiple versions of files are deleted within SharePoint by a single user. This could indicate an attempt to remove historical data or cover tracks.
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
Detects browser processes launching PowerShell, CMD, MSHTA, or WScript. This behavior aligns with ClearFake-style social engineering campaigns that instruct users to copy and execute malicious commands.
Detects execution chains where a suspicious DLL (autorun.dll) is loaded from user-controlled directories and followed by a silent MSI installation. This pattern is commonly associated with malware staging and secondary payload deployment.
This rule detects the creation or modification of user accounts on Windows systems by monitoring Security Event IDs 4741 (A security-enabled local group was created) and 4742 (A computer account was changed). It summarizes the count of such changes per hour by the subject user name, which can help identify unusual or excessive account management activities.
This rule detects an unusually high volume of logon events (both successful and failed) or a large number of unique users attempting to log on within a 5-minute window. This behavior is indicative of potential brute-force attacks or credential stuffing attempts against Windows systems.
Page 772 of 866