Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,511 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects potential file inclusion attempts by monitoring IIS web server logs for URI queries containing keywords like 'file=', 'path=', or 'input='. It then aggregates these attempts by client IP address over one-hour intervals and alerts if 10 or more such attempts are observed from a single IP within that timeframe, indicating a possible attack.
This rule detects attempts to access sensitive configuration or backup files on an IIS web server. It looks for requests where the URI stem contains keywords like '.env', 'config', or 'backup', which are commonly associated with files that may contain sensitive information.
This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.
This rule detects potential XML External Entity (XXE) injection attempts by looking for specific XML-related keywords ('<?xml' or 'DOCTYPE') within the URI query string of IIS web server logs. It triggers an alert if three or more such attempts are observed from the same IP address within a one-hour window, indicating a possible automated scanning or attack.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
This rule detects a high volume of POST requests to login, authentication, or password-related URI stems within a 5-minute window from unique IP addresses. This behavior is indicative of brute-force attacks or credential stuffing attempts against web applications.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
Detects repeated 'git clone' or 'git fetch' commands executed on a system within a short timeframe. This activity could indicate an adversary attempting to exfiltrate data from a code repository or staging environment, or rapidly pull down multiple repositories.
This rule detects a high frequency of process creations (Event ID 4688) with command-line arguments containing keywords indicative of software publishing or deployment, such as 'publish', 'deploy', 'artifact', or 'release'. A count of 3 or more such events within a one-hour window from the same computer and account is considered suspicious. This pattern could indicate legitimate CI/CD activities, but also potential abuse of software deployment tools or a software supply chain compromise by an adversary.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
Page 819 of 866