Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,495 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects potential 'reply-all' storm attacks or malicious mass emails sent to large distribution lists within the organization. It identifies emails sent to 50 or more recipients where the subject line contains phrases like 'reply all' or 'all members', originating from an internal company domain. The rule then counts such broadcast emails within one-hour bins to identify unusual activity.
This rule detects emails where the sender's address contains keywords like 'paypal', 'amazon', or 'apple' but does not originate from their official domains (e.g., '@paypal.com'). This pattern is indicative of lookalike domain phishing attempts, where attackers try to impersonate legitimate brands to trick recipients.
DHCP CalloutDLL
S1QL
Detects installation of a Callout DLL via CalloutDlls and CalloutEnabled registry parameters, which can be abused to execute code in the DHCP server context.
Detects known hashes of the Sunburst backdoor DLL.
Detects processes loading the Sunburst backdoor DLL.
Exploited SolarWinds process starting CMD with suspicious parameters.
Exploited SolarWinds process starting PowerShell with base64 in the command line.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.
Detects the creation of PowerShell or batch scripts within the C:\ProgramData directory, which is a common location abused by malware for payload staging and persistence. The rule specifically looks for file creation events where the initiating process is cmd.exe or powershell.exe and the file extension is either .ps1 or .bat.
Page 833 of 866