Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,506 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule identifies a high volume of HTTP 5xx errors (server-side errors) within a 5-minute interval from IIS logs. A count of 10 or more errors within this timeframe could indicate a web server under attack, a denial-of-service condition, or a critical application failure.
This rule detects potential path traversal attempts against an IIS web server by looking for sequences like '../' or '..\\' in the URI query string. It triggers an alert if five or more such attempts are observed from a single IP address within an hour, indicating a possible malicious scanning or exploitation attempt.
This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.
This rule detects potential file inclusion attempts by monitoring IIS web server logs for URI queries containing keywords like 'file=', 'path=', or 'input='. It then aggregates these attempts by client IP address over one-hour intervals and alerts if 10 or more such attempts are observed from a single IP within that timeframe, indicating a possible attack.
This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.
This rule detects potential XML External Entity (XXE) injection attempts by looking for specific XML-related keywords ('<?xml' or 'DOCTYPE') within the URI query string of IIS web server logs. It triggers an alert if three or more such attempts are observed from the same IP address within a one-hour window, indicating a possible automated scanning or attack.
Detects multiple attempts at command injection through IIS web server URI queries. The rule looks for common command execution functions like 'eval(', 'system(', or 'exec(' within the 'csUriQuery' field of W3C IIS logs. A threshold of 3 or more attempts from the same IP within an hour triggers the alert.
This rule detects potential open redirect attempts by monitoring W3C IIS logs for URI queries containing keywords like 'callback', 'redirect', or 'url='. It then aggregates these attempts by client IP address and time, triggering an alert if five or more such attempts are observed within an hour from a single IP. This pattern can indicate an attacker attempting to exploit an open redirect vulnerability to phish users or bypass security controls.
This rule detects an unusually high volume of registry access events (Event ID 4656) targeting either the 'HKLM' (HKEY_LOCAL_MACHINE) hive or 'System Registry' within a one-hour window. A count of 10 or more such events by a single user on a specific computer within an hour is considered suspicious. This activity could indicate an adversary attempting to enumerate system configurations, modify system settings for persistence, or gather information.
This rule detects suspicious activity where 'cmd.exe' or 'powershell.exe' are launched from 'explorer.exe' or 'taskmgr.exe' with a high frequency (3 or more times within an hour) by the same user on the same computer. This pattern can indicate an attacker attempting to gain command-line access or execute scripts after initial access, potentially bypassing direct execution from malicious processes.
Page 821 of 866