Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,548 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects emails containing multiple obfuscated URLs from common URL shortening services (bit.ly, tinyurl, short.link) originating from external senders. It specifically looks for emails with 3 or more such URLs within a one-hour window from the same sender.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Detects inbound RPC calls to the Windows Remote Registry interface using operation numbers associated with registry save/backup operations, which may indicate credential dumping via remote registry access. This rule specifically looks for RPC UUID '338cd001-2244-31f1-aaaa-900038001003' and operation numbers 20 or 31, which correspond to registry save/backup functions.
Detects outbound HTTPS traffic to known malicious infrastructure (supp0v3[.]com), used across all campaign waves for credential theft and remote access.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
Page 776 of 866