Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,506 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects rundll32.exe loading content directly from a UNC path. This behavior is rare in enterprise environments and was observed in ACR Stealer delivery chains.
Identifies mshta.exe accessing externally hosted HTA content from a user-initiated Explorer session, potentially indicating malicious remote code execution.
Detects named pipe activity with remote access enabled, initiated by JsonVMAccessExtension.exe running as SYSTEM. This may indicate abuse of the Azure VM Access Extension for unauthorized remote access.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
This rule detects potential data exfiltration attempts over non-standard network ports. It identifies devices that establish more than 5 network sessions to external (non-private IP) destinations on ports other than common ones like 80 (HTTP), 443 (HTTPS), 21 (FTP), 22 (SSH), 25 (SMTP), 110 (POP3), 143 (IMAP), 993 (IMAPS), and 995 (POP3S) within a one-hour window. This behavior can indicate an adversary attempting to bypass network monitoring by using less common ports for data transfer.
Identifies device code sign-ins originating from infrastructure previously associated with phishing operations and adversary-controlled relay servers.
Detects repository creation activity initiated by service accounts, integrations, or automated identities. Unexpected repository creation may indicate compromised CI/CD credentials, unauthorized automation, or preparation for source code exfiltration.
Detects execution chains where npm launches Node.js and Node.js subsequently launches Bun. This sequence may indicate malicious package execution, dependency confusion attacks, CI/CD compromise, or supply-chain abuse.
Detects command-line installation of VS Code extensions. Malicious Jupyter notebooks can simulate keystrokes to silently install rogue extensions that steal GitHub tokens.
Detects the creation of the specific PoC proof file (/tmp/hf_rce_poc_proof.txt) generated by the CVE-2026-4372 exploit payload targeting the HuggingFace Transformers library.
Page 823 of 866