Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,494 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects when a web browser initiates the execution of an executable (.exe), dynamic link library (.dll), JavaScript (.js), or VBScript (.vbs) file. This behavior can be indicative of malicious activity such as drive-by downloads, phishing attacks leading to malware execution, or exploitation of browser vulnerabilities.
Detects the execution of rundll32.exe with command-line arguments containing 'samcli.dll' or 'vaultcli.dll'. This pattern can indicate an attempt to execute malicious code or bypass security controls using a legitimate Windows utility.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
Detects suspicious GitHub-hosted payload retrieval. Argamal has been observed downloading encrypted components from GitHub repositories.
Detects execution of the malicious miner components associated with the Hola Browser supply-chain compromise. Researchers identified me.exe and HolaMonitorService.exe as unauthorized payloads bundled with affected installations.
This rule detects a high volume of HTTP/2 requests (more than 3000 per minute) originating from a single remote IP address, especially when these requests target a diverse set of URIs (more than 10 distinct URIs). This pattern can indicate a denial-of-service (DoS) attack, a web scanner, or other malicious automated activity attempting to overwhelm a service or enumerate resources.
This rule detects attempts to search for sensitive keywords like 'password', 'secret', 'credential', 'creds', 'apikey', 'token', or 'key' using 'findstr.exe' or 'reg.exe'. This activity can indicate an adversary attempting to discover credentials or other sensitive information on a compromised system.
Detects the creation or configuration of a Windows service using 'sc.exe' executed via 'cmd.exe', specifically looking for commands containing 'create' or 'config' along with 'binpath'. This activity can indicate persistence mechanisms or privilege escalation attempts by adversaries.
Detects multiple attempts at command injection through IIS web server URI queries. The rule looks for common command execution functions like 'eval(', 'system(', or 'exec(' within the 'csUriQuery' field of W3C IIS logs. A threshold of 3 or more attempts from the same IP within an hour triggers the alert.
Page 836 of 866