Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,538 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
Detects when a single account initiates a high volume of Office file (Word, Excel, PowerPoint) copy or move operations within a one-hour window. This could indicate data exfiltration or staging activities.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.
This rule detects a high volume of activity (10 or more events within an hour) to Windows administrative shares (C$, IPC$, ADMIN$) from a single source IP address. This behavior can indicate lateral movement, data exfiltration, or other malicious activity using legitimate administrative functions.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
This rule detects changes to the domain password policy by monitoring Windows Security Event ID 4739. It summarizes these events by the user who made the change and the time, providing an hourly count of policy modifications. This can help identify unauthorized or suspicious alterations to critical security policies.
This rule detects a high volume of remote desktop session changes (logon/logoff) for a single user within a one-hour window. Event IDs 4778 and 4779 indicate a session reconnected or disconnected, respectively. A high count (>=10) could suggest suspicious activity such as session hijacking, rapid reconnections by an attacker, or automated tools interacting with remote sessions.
Page 790 of 866