Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,495 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects high-volume data exfiltration attempts over common HTTPS ports (443 or 8443). It identifies network connections where more than 1MB of data is sent in a single connection, then aggregates these connections over one-hour intervals per device and remote IP. Finally, it flags any device that has sent a total of 50MB or more within that hour to a specific remote IP, indicating potential data exfiltration to a command and control server.
This rule detects a single process creating a large number of files with diverse file types within a short time frame (5 minutes). This behavior can be indicative of malicious activity such as ransomware encrypting files, data staging for exfiltration, or malware dropping multiple components.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects suspicious file downloads from the internet where common DLLs (wininet.dll, urlmon.dll, msxml3.dll) are initiating the file creation of executable, DLL, PowerShell, or batch files. The rule specifically looks for scenarios where 5 or more such files are created by the same initiating process on a device, indicating potential malicious activity like ingress tool transfer.
This rule detects suspicious execution of rundll32.exe by looking for multiple instances of rundll32.exe executing with command lines containing both '.dll' and '/' characters from the same computer and account. This pattern can indicate an adversary attempting to proxy execution of malicious code via rundll32.exe.
This rule detects an abnormal volume of large file downloads or exports from cloud applications, excluding SharePoint, OneDrive, and Teams. It identifies instances where a single account downloads or exports more than 3 files with an average size greater than 10 MB within an hour from a specific application and IP address. This behavior could indicate data exfiltration or unauthorized data access.
Detects instances where a significant number of files (50 or more) are deleted on a device within a 5-minute window. This can indicate malicious activity such as ransomware, data destruction, or an attacker attempting to cover their tracks.
This rule detects suspicious command-line obfuscation techniques by monitoring process creation events (EventID 4688) for specific patterns in the command line. It looks for the use of environment variables like %TEMP% or %SystemRoot%, the `${env:` syntax, and nested `cmd /c "cmd /c"` calls. These patterns are often used by adversaries to hide the true nature of executed commands, evade detection, or bypass security controls. The rule triggers if three or more such events are observed from the same computer and account within a one-hour window.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
Page 831 of 866