Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,240 copies160 likes55,485 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects potential lateral movement activities using `wmic.exe`, `psexec.exe`, or `wmiprvse.exe`. It specifically looks for these executables being run with command-line arguments indicative of remote execution or specific PsExec usage (e.g., containing backslashes for paths, `/accepteula`, or `-s`). The rule then aggregates these events and flags instances where the same process command line is observed multiple times on a device, and there are distinct remote targets involved, suggesting coordinated lateral movement.
Detects execution of Windows backup and recovery management utilities such as VSSAdmin, WBAdmin, DiskShadow, and BCDEdit with parameters commonly used to delete shadow copies, remove backup catalogs, or disable recovery features. These actions are frequently performed by ransomware operators to prevent victim recovery after encryption or wiping activities.
This rule detects instances where a single remote IP address exhibits a high number of idle network events (more than 200 idle events) and a high total number of network events (more than 500 total events) within a one-minute interval. This pattern can be indicative of Command and Control (C2) communication, where an adversary establishes a connection and then waits for commands, or data exfiltration, where data is sent in bursts with idle periods in between. It highlights unusual network communication patterns that might suggest malicious activity.
This rule detects the loading of modules (DLLs or executables) from user-specific AppData folders that are not commonly observed across the environment. It specifically excludes common legitimate paths within AppData like 'Local\Programs' and 'Local\Temp' to reduce false positives. The rule identifies modules loaded by processes that also originate from an AppData folder, indicating potentially suspicious activity such as malware or custom tools operating from user-writable locations.
Detects PowerShell commands performing web uploads or outbound data transfers. RedCurl has been observed using PowerShell-based HTTP requests to move collected data to cloud-hosted infrastructure.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
Detects the API call made by a client-side loader to fetch Magecart skimmer code hidden in Stripe metadata using a known attacker-controlled customer ID.
Detects network requests attempting to load specific malicious Google Tag Manager (GTM) containers associated with a Magecart campaign.
Detects creation of VNC-based services used for persistent remote access. The Huntress investigation identified registry modifications intended to enable VNC services and maintain attacker access.
Detects installation of Tiflux RMM components delivered through phishing campaigns. Threat actors abuse Tiflux to establish persistent remote access and subsequently deploy additional remote management tools.
Page 850 of 866