Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,514 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects modifications to registry keys or values associated with Potentially Unwanted Application (PUA) protection settings, specifically 'PUAProtection' and 'MpEnablePus'. Such modifications could indicate an attempt to disable or alter security features related to PUA detection.
Detects suspicious process activity originating from WSMProvHost, suggesting potential lateral movement or remote command execution
Detects execution chains where a suspicious DLL (autorun.dll) is loaded from user-controlled directories and followed by a silent MSI installation. This pattern is commonly associated with malware staging and secondary payload deployment.
Detects inbound RPC calls to the Windows Remote Registry interface using operation numbers associated with registry save/backup operations, which may indicate credential dumping via remote registry access. This rule specifically looks for RPC UUID '338cd001-2244-31f1-aaaa-900038001003' and operation numbers 20 or 31, which correspond to registry save/backup functions.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Identifies 'forfiles.exe' being executed with a combination of multiple command-line switches ('/c', '/p', '/m' or their hyphenated equivalents). This pattern can indicate automated scripting or malicious Living-off-the-Land activity, where 'forfiles.exe' is used to execute commands on multiple files or in specific directories.
Detects named pipe activity with remote access enabled, initiated by JsonVMAccessExtension.exe running as SYSTEM. This may indicate abuse of the Azure VM Access Extension for unauthorized remote access.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Identifies processes consistent with Cloudflare Quick Tunnel usage by detecting unauthenticated cloudflared executions that publish local services through the --url option. Such behavior may enable unauthorized external access to internal resources.
Identifies the creation of PowerShell or batch files in unusual ProgramData subdirectories by command-line interpreters, which may indicate malware staging or persistence preparation.
Page 815 of 866