Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,240 copies160 likes55,485 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects mshta.exe launched from Windows Explorer to retrieve remote HTA content over HTTP, a technique frequently observed in phishing campaigns and initial access attacks.
Detects execution of DWAgent from download or temporary directories rather than standard installation locations, potentially indicating unauthorized remote management activity.
This rule detects the creation of a new Windows service (EventID 7045) where the service executable path contains both 'System32' and 'svchost', and the service description is either empty or contains 'Network'. This combination of characteristics can indicate the installation of a malicious service, potentially a backdoor or trojan, attempting to masquerade as a legitimate system service.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
This rule detects suspicious file system enumeration activities that often precede ransomware encryption. It specifically looks for a high volume of command-line executions of 'dir /s', 'dir /r', or 'tree' commands within a short timeframe (5 minutes) on a single computer by a single account. These commands are commonly used by adversaries to discover files and directories before encrypting them.
This rule detects suspicious file creation or modification events in the root directory (C:\) for files commonly associated with boot sectors, such as 'bootsect.bak', 'bootloader', 'MBR', and 'VBR'. Such modifications can indicate ransomware activity or other forms of boot integrity compromise.
This rule detects potential ransomware activity by monitoring for a high volume of file creation or renaming events where the new file names end with common ransomware extensions such as '.encrypted', '.locked', or '.crypted'. It aggregates these events over 5-minute intervals and triggers if 50 or more such files are observed on a single device.
This rule detects suspicious file renaming activities indicative of ransomware. It specifically looks for files that previously had common document extensions (.doc, .xls, .ppt) being renamed to extensions commonly associated with encryption by ransomware (.encrypted, .locked, .crypted, .ecc). The rule triggers if 20 or more such renames occur within a 5-minute window on a single device.
Detects suspicious execution patterns indicative of ransomware utilizing batch scripts. This rule triggers when 'cmd.exe' or 'powershell.exe' execute at least 5 times within a 5-minute window, with command lines containing '.bat', '.cmd', or '/c', suggesting automated script execution often seen in ransomware attacks.
This rule detects suspicious file activity indicative of ransomware by monitoring for a high volume of file creations or renames where the filenames contain common ransomware-related extensions such as '.encrypted', '.locked', or '.ransom'. It aggregates these events over a one-hour period per device and triggers if 20 or more such events occur.
Page 846 of 866