Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,240 copies160 likes55,485 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects malware staging files in temporary directories before compression and exfiltration.
Detects local password validation using dscl . -authonly, a technique observed in ClickFix credential theft workflows.
Detects Terminal commands downloading remote content via curl and immediately piping it into bash or zsh, a common ClickFix execution pattern.
Detects repeated use of 7-Zip with archive creation and password-protection parameters. RedCurl operators extensively use password-protected archives to collect and prepare sensitive data for exfiltration.
This rule detects when a user account assigns a 'Global Administrator' or 'Owner' role from multiple distinct IP addresses within a one-hour window. This behavior can indicate a compromised account being used to escalate privileges or establish persistence from different locations.
This rule detects the creation of new service principals or the assignment of new role assignments to existing service principals in Azure Active Directory. It specifically looks for assignments that grant high-privilege roles such as "Contributor", "Owner", or "Global Admin". The rule aggregates these changes by target and time, highlighting instances where multiple changes or distinct initiators are involved.
This rule detects indicators of a multi-stage infection involving PlugX malware, often associated with the Mustang Panda threat group. It correlates process execution events where the command line contains "mustang", "panda", or "plugx" with either registry modifications containing the same keywords or network connections to a remote URL containing "/update". This correlation helps to identify more sophisticated attacks that involve multiple stages of execution, persistence, and communication.
This rule detects the creation or modification of registry run keys that contain specific keywords associated with PlugX malware and the Mustang Panda threat group. It specifically looks for modifications to the 'Run' key under 'Software\Microsoft\Windows\CurrentVersion' in the registry, which is a common persistence mechanism. The keywords 'plugx', 'mustang', 'panda', and 'plug' are used to identify suspicious registry value data.
This rule detects potential spearphishing attempts targeting high-value individuals (CEO, CFO, IT Admin) within an organization. It looks for emails sent to these individuals with subjects commonly associated with financial phishing or social engineering lures, such as "Invoice," "Wire Transfer," "Payment," "Urgent," or "Purchase Order." The rule also checks if these emails contain attachments, which is a common vector for delivering malware or credential harvesting documents in phishing campaigns. It summarizes the attempts by sender, recipient, and day, counting the number of attempts and listing the attachments.
This rule detects emails containing archive file attachments (zip, rar, 7z). It summarizes the count of such archives per sender, recipient, and file name over a daily period. The rule specifically looks for instances where at least one archive is present in an email.
Page 848 of 866