Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,523 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
This rule detects a single process creating a large number of files with diverse file types within a short time frame (5 minutes). This behavior can be indicative of malicious activity such as ransomware encrypting files, data staging for exfiltration, or malware dropping multiple components.
Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.
This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.
This rule detects suspicious command-line activity involving 'cscript' or 'wscript' (Windows Script Host) combined with keywords like 'download', 'execute', or 'powershell'. A high count of such events (3 or more within 5 minutes) from the same computer and account is flagged, indicating potential exploit kit activity, malicious script execution, or initial access attempts.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
This rule detects potential indicators of AI-powered adversarial attacks by monitoring process creation events (EventID 4688) for command lines containing keywords related to popular machine learning frameworks (TensorFlow, PyTorch, Keras) combined with terms like 'model', 'neural', or 'train'. A high count (2 or more) of such events within an hour on a single computer and account triggers an alert, suggesting the execution of AI/ML-related code that could be part of an adversarial attack or research.
Detects the creation or modification of inbox rules that forward or redirect emails to another recipient. This can be an indicator of an adversary attempting to exfiltrate emails or maintain persistence.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
Page 803 of 866