Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,497 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects repeated execution of 'net.exe' with commands related to user or group enumeration (e.g., 'net user', 'net localgroup', 'net group') without adding accounts. This behavior can indicate an adversary performing account discovery on a system or within a domain.
Detects large-scale file access on removable or secondary drives. GammaSteel has capabilities to harvest files from external storage devices.
Detects rapid access to large numbers of business documents within a short timeframe. GammaSteel is designed for large-scale document theft and collection.
Identifies HTTP/2 requests with excessive header counts to detect the memory amplification stage of an HTTP/2 Bomb DoS attack.
This rule detects modifications to registry keys or values associated with Potentially Unwanted Application (PUA) protection settings, specifically 'PUAProtection' and 'MpEnablePus'. Such modifications could indicate an attempt to disable or alter security features related to PUA detection.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
Detects abuse of the applescript:// execution mechanism used by newer ClickFix variants to bypass Apple's Terminal paste protections.
Detects creation of archives containing potentially harvested credential material before exfiltration.
Detects web server processes enumerating credential-containing files. Bissa harvested secrets from thousands of exposed applications.
Detects repeated access to cloud metadata services. Bissa operators harvested cloud credentials from compromised systems following initial access.
Page 834 of 866