Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,514 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
Medusa Ransomware Script Execution
This detection identifies behavior associated with the RedSun Microsoft Defender local privilege escalation (LPE) exploit.
The rule monitors for unauthorized modification of the Windows system binary TieringEngineService.exe or for process execution initiated by this binary running as SYSTEM. RedSun exploits a flaw in Microsoft Defender’s handling of cloud‑tagged files to overwrite this trusted SYSTEM‑level executable and then execute attacker‑controlled code with full SYSTEM privileges.
This activity is extremely rare during normal operations and strongly indicates a successful local privilege escalation and full system compromise.
The rule monitors for unauthorized modification of the Windows system binary TieringEngineService.exe or for process execution initiated by this binary running as SYSTEM. RedSun exploits a flaw in Microsoft Defender’s handling of cloud‑tagged files to overwrite this trusted SYSTEM‑level executable and then execute attacker‑controlled code with full SYSTEM privileges.
This activity is extremely rare during normal operations and strongly indicates a successful local privilege escalation and full system compromise.
This rule detects potential network port scanning activity by identifying a single source IP address attempting to connect to 10 or more distinct destination ports on a single destination IP address within a 5-minute window. This behavior is indicative of an attacker attempting to discover open services on a target host.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects emails with subjects related to financial transactions (Invoice, Purchase Order, PO, Payment, Order) that contain attachments with suspicious file extensions (.js, .hta, .vbs). It specifically filters for emails originating from domains not whitelisted as trusted and aggregates the count and average size of such attachments.
This rule detects the execution of known credential dumping tools, Mimikatz and ProcDump, when specific command-line arguments associated with credential extraction from LSASS are used. It specifically looks for `mimikatz.exe` or `procdump.exe` combined with arguments like `sekurlsa`, `logonpasswords`, or `-ma` which are commonly used to dump credentials from memory.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
This rule detects network connections where the User-Agent or RequestClientApplication header contains "NSIS_InetLoad". This string is often associated with Nullsoft Scriptable Install System (NSIS) installers, which can be used by legitimate software but also by malware to download additional components or communicate with command and control servers. The rule specifically looks for at least 3 such connections from the same source to the same destination within the aggregated timeframe, while excluding connections to Microsoft domains to reduce false positives.
Page 814 of 866