Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,538 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
This rule detects high volume data exfiltration (over 1GB) from devices to a list of known malicious IP addresses within a one-hour window. It specifically looks for network events where a significant amount of data (SentBytes > 100MB initially, then summed to over 1GB) is sent to hardcoded remote IP addresses associated with potential command and control or data exfiltration infrastructure.
This rule detects modifications to registry keys (EventID 4657) where the new value contains strings commonly associated with Command and Control (C2) configurations, such as 'C2', 'beacon', 'callback', 'command_server', 'c2_ip', or 'control_server'. This could indicate an adversary establishing or modifying C2 communication channels via the registry.
Detects the creation of files with names commonly associated with LockBit ransomware, such as '.lockbit', 'lockbit_note', or '.abcd'. This rule specifically looks for these file names being created on devices, which is indicative of ransomware activity.
Identifies potentially malicious inbox rules used to hide emails, forward messages externally, or facilitate business email compromise activity.
Detects newly registered devices following account compromise. Threat actors frequently register rogue devices after obtaining tokens to maintain persistence.
This rule detects network connections initiated by the 'teams.exe' process to public IP addresses. It specifically looks for outbound connections from the Microsoft Teams application to external, non-private IP ranges. This could be used to monitor unusual external communication patterns from Teams, although the specific intent without further context is unclear.
Page 786 of 866