Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,494 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects the execution of 'mshta.exe' when its command line contains a URL pointing to a '.7z' archive. This behavior is suspicious as mshta.exe is often abused by adversaries to download and execute malicious content, and downloading an archive directly via mshta.exe is not a typical legitimate use case.
This rule detects suspicious activity involving API key rotation followed by high usage. It correlates audit logs for API key operations (rotate, update, create) with cloud application events showing API requests or token usage. Specifically, it looks for instances where an API key is rotated, updated, or created, and then subsequently used more than 50 times within a day by the same actor. This could indicate an adversary gaining access to an API key and then rapidly utilizing it for malicious purposes.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
This rule detects suspicious DLL side-loading activity. It looks for DLL files being loaded from common user-writable or temporary directories (like `\temp\` or `\users\`) by legitimate Windows processes such as `rundll32.exe`, `explorer.exe`, or `svchost.exe`. The rule specifically flags instances where a DLL is loaded more than 3 times within an hour by these processes, indicating potential malicious activity where an adversary might be attempting to execute their own malicious DLLs by hijacking the loading process of a legitimate application.
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
This rule detects potential internal phishing campaigns by identifying newly observed sender domains that send emails to a large number of internal recipients within a short period. It looks for sender domains that have been seen for the first time within the last 7 days, have sent emails to more than 10 unique recipients, and have sent more than 5 emails in total. This behavior can indicate an attacker attempting to phish internal users from a newly created or compromised domain.
This rule detects potential phishing attempts impersonating Adobe Document Cloud. It looks for emails with subjects containing keywords like "Adobe", "Document Cloud", "Sign Document", or "View Document", but where the sender's domain is NOT a legitimate Adobe domain (adobe.com or documentcloud.adobe.com). The rule then counts these occurrences per sender address and domain over a daily period.
Detects creation or modification of LaunchAgent plist files used for persistence.
Detects use of xattr commands to remove quarantine attributes from downloaded files before execution.
Detects creation of Windows services using Service Control Manager (SC.exe). Ransomware operators frequently leverage services for remote deployment, privilege escalation, persistence, or mass execution across multiple systems. Multiple service creation events within a short timeframe may indicate ransomware staging activity.
Page 838 of 866