Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,491 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects URL clicks associated with the Moduba cloaking and redirect campaign using UrlClickEvents. Focuses on specific domain IOCs, redirect chains, and beaconing behaviors.
Storm-1175 Malicious File Hashes
A malicious campaign utilizes UPX-packed Borland Delphi binaries masquerading as AIMP portable software to exfiltrate system data and capture screenshots.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
This alert detects potentially suspicious command entries written to the RunMRU registry key by explorer.exe, which is commonly used to store user-executed commands from the Windows Run dialog. While RunMRU activity is often benign, this detection specifically looks for indicators that may suggest malicious or risky behavior, including the presence of scripting engines, command-line utilities, download or execution functions, encoded payload patterns, or unusual symbols. Such artifacts are frequently associated with adversary techniques involving user-assisted execution, obfuscated commands, or living-off-the-land binaries (LOLBins). The activity warrants review to determine whether the command originated from legitimate user behavior or represents an attempt to execute or stage malicious code through the Run dialog.
This rule detects when an 'Agent ID Administrator' role adds an owner to a service principal in Azure Active Directory. This activity could indicate an attempt to escalate privileges or maintain persistence within the Azure environment by granting control over service principals to potentially unauthorized entities.
KQL Query
Detects when a browser navigates to or launches with a 'blob:https://' URL. This can indicate unusual browser activity, potentially related to data exfiltration, web-based attacks, or specific application behaviors that might warrant investigation.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Page 842 of 866