Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,530 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects a high volume of access attempts (10 or more within an hour) by a single user to sensitive system directories such as 'Admin' or 'System32'. This behavior could indicate an adversary performing file and directory discovery, attempting to access sensitive files, or staging for further malicious activity.
Detects the use of regsvr32.exe to execute a remote scriptlet (.sct file) via a URL, a technique often referred to as 'Squiblydoo'. This method bypasses application control by leveraging a trusted Microsoft binary to proxy execution of malicious code.
Identifies .lnk files dropped into Startup folders, a persistence technique tied to WinRAR exploitation.
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
Identifies 'forfiles.exe' being executed with a combination of multiple command-line switches ('/c', '/p', '/m' or their hyphenated equivalents). This pattern can indicate automated scripting or malicious Living-off-the-Land activity, where 'forfiles.exe' is used to execute commands on multiple files or in specific directories.
This rule detects an unusually high volume of successful network connections over SMB (ports 135, 139, 445) originating from a single account within a one-hour window. This behavior can be indicative of lateral movement, reconnaissance, or data exfiltration activities using SMB/RPC.
This rule detects an unusually high volume of file deletion events on a device within a short time frame (100 or more files deleted within a 5-minute window). This activity can be indicative of malicious behaviors such as ransomware encrypting and deleting original files, data wiping attacks, or an adversary attempting to remove forensic evidence by deleting logs or other critical files.
This rule detects when three or more Windows services are created or modified on a single computer within a one-hour period. It specifically looks for Event IDs 4697 (A service was installed in the system) and 7045 (A service was installed in the system). This could indicate malicious activity such as persistence mechanisms or privilege escalation attempts.
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
Page 796 of 866