Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,517 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
Detects suspicious PowerShell execution chains (-nop, -w hidden, iex (gc) used in ClickFix RAT delivery.
Identifies creation of scheduled tasks using names observed in malware and cryptojacking campaigns attempting to establish persistence.
Detects emails matching the Microsoft-reported AiTM phishing campaign that used Code of Conduct review lures and PDF attachments.
Correlates user interaction with email URLs and subsequent risky sign-ins occurring shortly afterward. Commonly observed in adversary-in-the-middle (AiTM) campaigns.
Detects Bun or Node.js processes communicating with cloud metadata service endpoints. This behavior is frequently associated with credential harvesting, cloud reconnaissance, token theft, and post-exploitation activity.
Detects download activity targeting Bun binaries or release packages from GitHub-hosted repositories. Adversaries may dynamically download Bun at runtime to execute malicious JavaScript payloads without embedding tooling inside container images or endpoints.
Detects Bun processes launched from temporary locations within containers. This behavior may indicate unauthorized package execution, workload drift, malicious tooling deployment, or post-compromise activity in cloud-native environments.
Detects a Python process spawning curl to make outbound web requests. This behavior aligns with the PoC for CVE-2026-4372 (HuggingFace Transformers RCE), where Python sub-processes curl to exfiltrate credentials.
Detects creation of Windows QoS policies configured with extremely low bandwidth limits using the New-NetQosPolicy PowerShell cmdlet. Adversaries may abuse this technique to disrupt EDR communications, delay telemetry uploads, and evade detection.
Page 807 of 866