Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,523 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects potential command and control (C2) communications over non-standard ports. It identifies devices that make a high number of network connections to distinct remote IP addresses on ports other than common ones (80, 443, 53, 22, 21, 25, 110, 143, 993, 995) and not to private IP ranges. The rule aggregates connection counts and distinct remote IPs over 15-minute intervals and flags activity where there are more than 30 connections and more than 2 distinct remote IPs.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
This rule detects potential DNS tunneling activity by looking for an unusually high volume of DNS queries of type TXT or NULL, or DNS queries with exceptionally long names (50 characters or more), originating from multiple distinct clients within a one-hour window. This pattern is often indicative of adversaries exfiltrating data or establishing command and control through DNS.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Detects execution of OneDriveUpdater.exe from C:\ProgramData, which may represent a masqueraded binary attempting to impersonate legitimate Microsoft software. This could indicate an attempt at defense evasion or persistence by an attacker.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Page 801 of 866