Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,495 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects suspicious file system enumeration activities that often precede ransomware encryption. It specifically looks for a high volume of command-line executions of 'dir /s', 'dir /r', or 'tree' commands within a short timeframe (5 minutes) on a single computer by a single account. These commands are commonly used by adversaries to discover files and directories before encrypting them.
This rule detects suspicious file creation or modification events in the root directory (C:\) for files commonly associated with boot sectors, such as 'bootsect.bak', 'bootloader', 'MBR', and 'VBR'. Such modifications can indicate ransomware activity or other forms of boot integrity compromise.
This rule detects suspicious file renaming activities indicative of ransomware. It specifically looks for files that previously had common document extensions (.doc, .xls, .ppt) being renamed to extensions commonly associated with encryption by ransomware (.encrypted, .locked, .crypted, .ecc). The rule triggers if 20 or more such renames occur within a 5-minute window on a single device.
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects potential command and control (C2) beaconing activity by monitoring network events for specific URL patterns and user agent strings associated with known C2 frameworks like AzureVeil and Adaptix. It identifies beaconing if multiple devices communicate with the same remote IP address using these indicators within a 15-minute window, with more than 5 beacon counts and more than 1 distinct device.
Detects attempts to establish persistence by modifying registry run keys (Run or RunOnce) to execute scripting interpreters like PowerShell, cmd, or wscript. The rule looks for at least two such events within an hour on the same device and registry key, indicating potential malicious activity.
This rule detects a high volume of PowerShell or Command Prompt executions from a single computer by a single account within a one-hour window. This behavior can be indicative of an APT-style multi-stage attack pattern where an adversary is executing numerous commands in quick succession, potentially for discovery, execution, or privilege escalation. The rule specifically looks for command lines containing 'powershell' and '-enc' (encoded command) or 'cmd' and '/c' (execute command and terminate).
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.
This rule detects potential phishing attempts by identifying emails with URLs that originate from outside the internal company domain (@company.com). It specifically looks for emails where the subject line contains keywords like 'click', 'confirm', or 'update', and where multiple such emails (3 or more) are sent from the same external sender to the same recipient.
Page 832 of 866