Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,502 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
Detects instances where rundll32.exe is launched by explorer.exe and includes command-line parameters indicative of network communication (http, https) or WebDAV activity (davclnt.dll, WebDAV, \\). This behavior can be associated with forced authentication attempts or execution of remote code.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
Detects suspicious execution of rundll32.exe initiated by explorer.exe that includes network-related command-line arguments (http, https, .dll, entrypoint). This pattern can indicate malicious DLL loading or execution attempting to establish network communication, potentially for command and control or data exfiltration. The rule filters out common system accounts and focuses on infrequent occurrences.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
Detects network connections to known IP addresses and domains associated with the Adobe Reader zero-day C2 infrastructure.
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
This rule detects a high volume of network connection retries (more than 500 within a one-minute window) to a distinct remote IP address. This behavior can be indicative of a network denial-of-service (DoS) attack, where an attacker attempts to overwhelm a target by repeatedly trying to establish connections.
This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.
Page 829 of 866