Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,502 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects potential Kerberos Constrained Delegation attacks by monitoring Security Event ID 4769 (A Kerberos service ticket was requested) for tickets with the '0x80000000' option, which indicates a forwardable ticket. The rule then aggregates these events by target username, client address, and IP address, flagging instances where 8 or more such tickets are requested, which could indicate an attempt to abuse constrained delegation.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
Detects emails originating from sender addresses identified by Microsoft as part of the April 2026 "Code of Conduct" adversary-in-the-middle (AiTM) phishing campaign that targeted Microsoft 365 users and attempted to steal authentication tokens.
Detects access to npm token management and identity endpoints. This activity may indicate attempts to enumerate authentication tokens, validate account access, or prepare for software supply-chain compromise.
Detects command-line activity searching for secret-related values within application or runner configurations. Attackers commonly enumerate secrets, credentials, API keys, and environment variables immediately after gaining access to CI/CD infrastructure.
Detects Bun runtime execution from temporary or user-writable directories such as /tmp/ or Windows Temp folders. Threat actors increasingly leverage Bun as an alternative JavaScript runtime to execute payloads directly from temporary locations and evade traditional application controls.
Detects the execution of Jupyter Notebooks from unexpected or temporary locations. Crafted Jupyter notebooks are the primary delivery mechanism for exploiting a zero-click/one-click GitHub token theft vulnerability in VS Code.
Detects unusual or suspicious child processes spawned by Visual Studio Code, which could indicate Remote Code Execution (RCE) stemming from a malicious Jupyter notebook on the desktop client.
Detects potential screenshot collection activity. Argamal supports screen capture functionality as part of its RAT capabilities.
This rule detects suspicious activity related to the assignment of application roles. Specifically, it identifies when a single user principal name (UPN) performs 10 or more successful 'Add app role assignment' operations within a one-hour window. This could indicate an attacker rapidly granting themselves or other entities access to multiple applications or resources.
Page 827 of 866