Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,497 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects web application processes accessing .env files shortly after execution activity. Bissa Scanner harvested environment files immediately after successful exploitation to collect secrets and credentials.
Detects repeated file-system enumeration activity across a host. Huntress observed RedCurl conducting extensive file discovery before staging and exfiltrating sensitive corporate data.
This rule detects network connections or DNS queries made to the domain 'data-seed-prebsc-1-s1.binance.org'. This domain is associated with the Binance Smart Chain testnet. Connections to such domains from enterprise environments might indicate unauthorized cryptocurrency-related activities, potential malware beaconing, or other policy violations.
This rule detects a pattern indicative of password spraying or brute force attacks against user accounts. It identifies instances where a single user principal name (UPN) and IP address combination has at least 5 failed sign-in attempts and at least 1 successful sign-in attempt within a 30-minute window. This combination of failed and successful logins from the same source for the same user suggests an attacker successfully guessed a password after multiple attempts, or a password spraying attack where one of the sprayed passwords was correct.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
Detects commands referencing known C0XMO payload locations while interacting with cron jobs or shell startup files. This behavior may indicate an attempt to maintain persistence across system reboots.
Detects Python or pip processes installing libraries associated with C0XMO botnet activity, specifically paramiko and beautifulsoup4. These packages are commonly used by the malware for SSH-based propagation, reconnaissance, and automated scanning.
Detects creation of multiple archives in a short period. GammaSteel commonly stages collected documents into archives before exfiltration.
Detects archive creation immediately followed by substantial outbound communications, consistent with credential collection and exfiltration workflows observed in the Bissa operation.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
Page 835 of 866