Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,502 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects the creation of new service principals or the assignment of new role assignments to existing service principals in Azure Active Directory. It specifically looks for assignments that grant high-privilege roles such as "Contributor", "Owner", or "Global Admin". The rule aggregates these changes by target and time, highlighting instances where multiple changes or distinct initiators are involved.
This rule detects potential credential abuse of service principals or applications by identifying an unusual number of activities from a single service principal or application across multiple distinct IP addresses within a one-hour window. It specifically monitors sign-in logs for applications like 'Azure CLI', 'GitHub', or 'CustomApp' where the user type is 'ServicePrincipal' or 'Application'. A threshold of more than 10 activities and more than 2 distinct IP addresses within an hour triggers an alert.
This rule detects suspicious activity involving API key rotation followed by high usage. It correlates audit logs for API key operations (rotate, update, create) with cloud application events showing API requests or token usage. Specifically, it looks for instances where an API key is rotated, updated, or created, and then subsequently used more than 50 times within a day by the same actor. This could indicate an adversary gaining access to an API key and then rapidly utilizing it for malicious purposes.
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
Detects inbound RPC calls to the Server Service interface using operation number 12 (NetrSessionEnum), which may indicate remote session enumeration for account discovery and reconnaissance.
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
Detects the creation of PowerShell or batch scripts within the C:\ProgramData directory, which is a common location abused by malware for payload staging and persistence. The rule specifically looks for file creation events where the initiating process is cmd.exe or powershell.exe and the file extension is either .ps1 or .bat.
Page 830 of 866