Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,548 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects a high volume of POST requests to login, authentication, or password-related URI stems within a 5-minute window from unique IP addresses. This behavior is indicative of brute-force attacks or credential stuffing attempts against web applications.
This rule detects a high volume of access attempts to the IPC$ administrative share from a single source IP address within a one-hour window. This behavior can be indicative of reconnaissance, lateral movement, or other malicious activities using SMB/Windows Admin Shares.
This rule detects an unusually high volume (5 or more within an hour) of successful logons by 'SYSTEM' or 'LOCAL SERVICE' accounts. While these are legitimate system accounts, a sudden surge in their logon activity could indicate unusual system behavior, potential compromise, or misconfiguration leading to excessive system account usage.
Detects unusually large outbound network data transfers (over 1TB) from a single process account within an hour. This could indicate data exfiltration, unauthorized bulk data synchronization, or other malicious activity where large volumes of data are being moved out of the environment.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
Page 778 of 866