Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,524 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects suspicious command-line activity involving utilities that contain 'checksum' or 'hash' in their command line, potentially indicating file integrity checks, malware analysis evasion, or credential dumping attempts. The rule triggers if five or more such commands are executed within an hour by the same account on the same computer.
This rule detects when a single computer account performs five or more 'docker pull' or 'docker build' commands within an hour. This could indicate an adversary staging tools or building malicious images on a compromised host.
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
Detects when a user account is deleted on a Windows system. This event (EventID 4726) is critical for monitoring potential malicious activity, such as an attacker attempting to remove traces of their presence or disrupt operations by deleting legitimate user accounts.
This rule detects the execution of processes where the command line contains keywords commonly associated with privilege escalation or gaining administrative privileges, such as 'getadmin' or 'privesc'. It monitors Windows Security Event ID 4688, which logs process creation.
This rule detects repeated attempts to use privileges for access checks (EventID 4673) by a single user within a one-hour window, excluding the 'SeTrustedCredentialManagerAccessPrivilege'. A high count of such events (5 or more) could indicate an attempt at privilege escalation or unusual system access behavior.
This rule detects when a user account repeatedly (3 or more times within an hour) requests either 'SeDebugPrivilege' or 'SeImpersonatePrivilege' (Event ID 4672). This behavior can be indicative of an attacker attempting to escalate privileges or manipulate access tokens, often seen in techniques like token impersonation or debugging processes for malicious purposes.
This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
Page 805 of 866