Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,240 copies160 likes55,485 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects MSI installers launched directly from a web browser. In the Tiflux campaign, victims were lured through fake document pages and CAPTCHA screens before downloading and executing malicious MSI installers.
Detects systems running multiple remote access and management products within a short period. Huntress observed attackers deploying Tiflux together with ScreenConnect, Splashtop, and UltraVNC to maintain redundant access channels.
This rule detects a high number of distinct URLs and total network connections originating from a single remote IP address within a one-minute time window. This behavior can be indicative of various malicious activities such as data exfiltration, command and control (C2) communication, or network scanning. The threshold for distinct URLs is set to greater than 100 and total connections greater than 500.
This rule detects devices making a high volume of outbound network connections (more than 1000 connections within a one-minute window) to a single remote IP address. This behavior could indicate a network denial-of-service (DoS) attack originating from the device, or potentially other forms of high-volume network activity such as data exfiltration or scanning.
Detects network connections and DNS queries to the Binance Smart Chain testnet endpoint 'data-seed-prebsc-1-s1.binance.org', which AnimateClipper uses to resolve its actual C2 domain via a smart contract.
Detects COM object hijacking through InprocServer32 modifications. Argamal establishes persistence using COM hijacking mechanisms.
Detects PowerShell download activity associated with Argamal's second-stage payload retrieval.
Detects FFmpeg DLL loading outside expected application directories. Argamal abuses modified FFmpeg libraries to initiate execution.
Detects Windows Defender exclusion modifications. The malicious Hola miner was observed adding exclusions before beginning mining operations.
Detects creation of the malicious persistence service observed during the Hola Browser compromise.
Page 849 of 866