Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,502 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
This rule detects an unusual number of process creations (Event ID 4688) containing both 'security' and 'patch' in their command line within a one-hour window on a single computer. This could indicate automated patching activity, but a high volume might also suggest suspicious system modifications or an attempt to disguise malicious activity as legitimate patching.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
This rule detects the creation of new processes where the command line contains keywords such as 'exploit' or 'vulnerability'. This could indicate an attempt to execute an exploit or leverage a known vulnerability, potentially as part of an attack.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule detects the execution of processes where the command line contains keywords commonly associated with malware, specifically 'backdoor', 'rootkit', or 'trojan'. It monitors Windows Security Event ID 4688 (a process creation event) and flags any command lines containing these terms.
Detects devices making a high volume (5 or more per hour) of successful network connections to remote URLs containing 'update' or 'patch' on port 443 (HTTPS). This could indicate legitimate system updates, but also potentially malicious update checks or beaconing activity.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
Flags mutex creation (CPFATE) in .NET runtime, linked to Grixba ransomware scanner variants.
Page 826 of 866