Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,543 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects high-volume data exfiltration attempts over common HTTPS ports (443 or 8443). It identifies network connections where more than 1MB of data is sent in a single connection, then aggregates these connections over one-hour intervals per device and remote IP. Finally, it flags any device that has sent a total of 50MB or more within that hour to a specific remote IP, indicating potential data exfiltration to a command and control server.
KQL Query from file: Query_79_TrojanRootkitInstallation.kql
Detects PowerShell-based file discovery and archive creation commonly associated with GammaSteel collection operations.
This rule detects modifications to Windows Registry Run keys (Run, RunOnce, RunOnceEx, Policies\Run) where the new value contains common scripting interpreters like PowerShell, cmd, cscript, or wscript, and the path is not within the System32 directory. This behavior is indicative of an adversary attempting to establish persistence by ensuring their malicious script or command executes upon user login.
This rule detects suspicious access attempts to file system objects (hard disk volumes or DOS devices) by non-system accounts. It specifically looks for Event ID 4656 (Handle to an Object was Requested) where the ObjectName contains "\Device\HarddiskVolume" or "\DosDevices\", the AccessMask indicates broad access (0x1fffff or 0x120089), and the SubjectUserName is not a standard system account (SYSTEM, LOCAL SERVICE, NETWORK SERVICE). The rule then aggregates these events over one-hour intervals and flags if five or more such access attempts occur from the same computer and user.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring the creation of processes for 'fodhelper.exe', 'computerdefaults.exe', or 'slui.exe' when their parent process is not 'explorer.exe' or 'svchost.exe'. These executables are known to be used in UAC bypass techniques to elevate privileges without user interaction.
This rule detects suspicious command-line activity indicative of Windows Management Instrumentation (WMI) being used for command execution. It specifically looks for `SecurityEvent` with `EventID 4688` (a process creation event) where the `CommandLine` contains keywords associated with WMI operations like `wmic process call create`, `wmic service`, `wmic os`, or `Get-WmiObject`, combined with selection or filtering keywords such as `select`, `where`, or `-ComputerName`. The rule triggers if three or more such events occur within an hour from the same computer and user.
This rule detects anomalous network communication patterns that might indicate Command and Control (C2) activity. It identifies devices making at least 5 connections within a 10-minute window to common web/HTTPS ports (443, 8443, 8080) where the initiating process is not a standard web browser (chrome.exe, firefox.exe, iexplore.exe, msedge.exe). This pattern can suggest non-browser applications establishing frequent connections to C2 servers.
This rule detects unusual child processes spawned from critical Windows system binaries (svchost.exe, lsass.exe, csrss.exe, winlogon.exe, system.exe). Specifically, it looks for these parent processes launching command-line interpreters or scripting engines like PowerShell, cmd, Python, or Java, excluding common legitimate child processes such as conhost.exe, csc.exe, taskkill.exe, and services.exe. A count of 2 or more such events within an hour on the same computer triggers an alert, indicating potential malicious activity like privilege escalation or execution.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
Page 784 of 866