Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,538 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
This rule detects an unusual number of HTTP OPTIONS or TRACE method requests from a single IP address within a one-hour window. While these methods have legitimate uses, their frequent or excessive use can indicate reconnaissance, vulnerability scanning, or attempts to bypass security controls. The rule triggers if 5 or more such requests are observed from the same IP within an hour.
Detects IP addresses generating a high volume of web requests to an IIS server where the referrer is external to the host. This can indicate web scraping, reconnaissance, or denial-of-service attempts.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects a high volume of access attempts (5 or more within an hour) to administrative shares (C$, D$, E$, ADMIN$) from a single source IP address. This activity can be indicative of lateral movement, data exfiltration, or reconnaissance by an adversary attempting to gain access to sensitive information or spread malware across the network.
This rule detects an unusually high number of process creations using 'RunAs' within a one-hour window by a single user. A count of 5 or more 'RunAs' commands within an hour could indicate an attempt at privilege escalation or lateral movement, potentially by an attacker trying to execute commands with different user contexts.
Page 788 of 866