Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,491 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects suspicious DLL side-loading activity. It looks for DLL files being loaded from common user-writable or temporary directories (like `\temp\` or `\users\`) by legitimate Windows processes such as `rundll32.exe`, `explorer.exe`, or `svchost.exe`. The rule specifically flags instances where a DLL is loaded more than 3 times within an hour by these processes, indicating potential malicious activity where an adversary might be attempting to execute their own malicious DLLs by hijacking the loading process of a legitimate application.
This rule detects potential ransomware activity by identifying a high volume of file encryption events. It looks for files being renamed or created with common ransomware-related extensions such as '.locked', '.crypt', '.encrypted', '.enc', or a generic pattern of a 6 or more character alphanumeric extension. The rule then counts these events within one-hour bins and alerts if more than 20 such files are detected in a single folder path.
This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.
This rule detects the execution of 'mshta.exe' when its command line contains a URL pointing to a '.7z' archive. This behavior is suspicious as mshta.exe is often abused by adversaries to download and execute malicious content, and downloading an archive directly via mshta.exe is not a typical legitimate use case.
Detects the creation of disk image files (ISO, IMG, VHD, VHDX, WIM) within temporary folders under a user's AppData directory. This activity can be indicative of malware staging or unpacking, often associated with initial access techniques where malicious payloads are delivered as disk images.
Detects suspicious process activity originating from WSMProvHost, suggesting potential lateral movement or remote command execution
This rule detects the loading of modules (DLLs or executables) from user-specific AppData folders that are not commonly observed across the environment. It specifically excludes common legitimate paths within AppData like 'Local\Programs' and 'Local\Temp' to reduce false positives. The rule identifies modules loaded by processes that also originate from an AppData folder, indicating potentially suspicious activity such as malware or custom tools operating from user-writable locations.
Identifies device code sign-ins originating from infrastructure previously associated with phishing operations and adversary-controlled relay servers.
Detects newly registered devices following account compromise. Threat actors frequently register rogue devices after obtaining tokens to maintain persistence.
Detects mailbox access events from IP addresses or networks uncommon for the user. Frequently observed after successful token theft.
Page 843 of 866