Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,530 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
This rule detects when a single account initiates 5 or more successful Remote Desktop Protocol (RDP) connections within a one-hour window. This behavior can be indicative of an adversary attempting to gain widespread access within a network, potentially through credential stuffing, brute-force attacks, or lateral movement using compromised credentials.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
This rule detects an unusually high volume (10 or more within an hour) of permission changes to files or registry keys by a single user. This activity can be indicative of an adversary attempting to modify access controls to facilitate persistence, privilege escalation, or defense evasion.
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
This rule detects a high volume of group membership changes (additions or removals) by a single user within a one-hour window. Event IDs 4728 (A member was added to a security-enabled global group), 4729 (A member was removed from a security-enabled global group), and 4730 (A member was removed from a security-enabled universal group) are monitored. A count of 5 or more such events by the same user within an hour is flagged as suspicious, potentially indicating malicious account manipulation or privilege escalation attempts.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects an unusual frequency of command-line executions containing the terms 'compliance' or 'audit' on a single computer within a one-hour window. This activity could indicate an adversary performing reconnaissance or discovery to understand system configurations, security policies, or auditing mechanisms.
This rule detects potential vulnerability scanning activity by identifying multiple network connection attempts to common vulnerable ports (135, 139, 445) where the remote URL contains keywords like 'vuln' or 'scan'. It aggregates these activities by device and time, flagging devices with 5 or more such connections within an hour.
Page 797 of 866