Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,240 copies160 likes55,485 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects deployment of the vulnerable HwRwDrv driver observed in Tiflux-related intrusions. This driver has been previously associated with privilege escalation and defense evasion techniques.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
Detects a device making an unusually high number of unique outbound network connections to different remote IP addresses within a short time frame (5 minutes). This behavior can indicate various malicious activities such as network scanning, botnet activity, or data exfiltration to multiple external hosts.
Detects a large number of file modification and rename operations occurring within a short period of time across multiple directories. This behavior is commonly associated with ransomware encryption activity, including the VECT ransomware family. The rule identifies processes rapidly modifying files, which may indicate active encryption or destructive file operations.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
Detects when a browser navigates to or launches with a 'blob:https://' URL. This can indicate unusual browser activity, potentially related to data exfiltration, web-based attacks, or specific application behaviors that might warrant investigation.
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
KQL Query
Detects ClickFix‑style social engineering where a user is tricked into executing a single pasted command that chains multiple malicious actions: storing attacker‑controlled credentials via cmdkey and executing a remote DLL over a UNC path using regsvr32. This fileless, LOLBin‑based execution enables credential abuse and remote code execution without dropping an initial payload to disk.
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
Page 852 of 866