Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,241 copies160 likes55,491 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects delivery of known PDF attachments used in the Code of Conduct credential theft campaign.
Detects RuntimeHost.exe launched from an unusual cache directory frequently associated with malware staging and cryptomining activity.
Identifies creation of scheduled tasks using names observed in malware and cryptojacking campaigns attempting to establish persistence.
Detects rundll32.exe loading content directly from a UNC path. This behavior is rare in enterprise environments and was observed in ACR Stealer delivery chains.
Detects outbound internet communications generated by rundll32.exe, which is uncommon and frequently associated with malware execution, including ACR Stealer.
Detects browser processes launching PowerShell, CMD, MSHTA, or WScript. This behavior aligns with ClearFake-style social engineering campaigns that instruct users to copy and execute malicious commands.
Detects files staged in C:\Users\Public\Music via RDP (mstsc.exe), a known Grixba ransomware scanner behavior.
Flags mutex creation (CPFATE) in .NET runtime, linked to Grixba ransomware scanner variants.
Identifies .lnk files dropped into Startup folders, a persistence technique tied to WinRAR exploitation.
Detects suspicious PowerShell execution chains (-nop, -w hidden, iex (gc) used in ClickFix RAT delivery.
Page 844 of 866