Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,240 copies160 likes55,485 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects when an 'Agent ID Administrator' role adds an owner to a service principal in Azure Active Directory. This activity could indicate an attempt to escalate privileges or maintain persistence within the Azure environment by granting control over service principals to potentially unauthorized entities.
This alert detects potentially suspicious command entries written to the RunMRU registry key by explorer.exe, which is commonly used to store user-executed commands from the Windows Run dialog. While RunMRU activity is often benign, this detection specifically looks for indicators that may suggest malicious or risky behavior, including the presence of scripting engines, command-line utilities, download or execution functions, encoded payload patterns, or unusual symbols. Such artifacts are frequently associated with adversary techniques involving user-assisted execution, obfuscated commands, or living-off-the-land binaries (LOLBins). The activity warrants review to determine whether the command originated from legitimate user behavior or represents an attempt to execute or stage malicious code through the Run dialog.
This detection identifies behavior associated with the RedSun Microsoft Defender local privilege escalation (LPE) exploit.
The rule monitors for unauthorized modification of the Windows system binary TieringEngineService.exe or for process execution initiated by this binary running as SYSTEM. RedSun exploits a flaw in Microsoft Defender’s handling of cloud‑tagged files to overwrite this trusted SYSTEM‑level executable and then execute attacker‑controlled code with full SYSTEM privileges.
This activity is extremely rare during normal operations and strongly indicates a successful local privilege escalation and full system compromise.
The rule monitors for unauthorized modification of the Windows system binary TieringEngineService.exe or for process execution initiated by this binary running as SYSTEM. RedSun exploits a flaw in Microsoft Defender’s handling of cloud‑tagged files to overwrite this trusted SYSTEM‑level executable and then execute attacker‑controlled code with full SYSTEM privileges.
This activity is extremely rare during normal operations and strongly indicates a successful local privilege escalation and full system compromise.
KQL Query from file: Detection for ShadowHound
This rule detects an unusually high volume of network share access attempts from a single IP address and account within a short time frame (5 minutes). This could indicate an adversary attempting to discover or access network shares, potentially for data exfiltration or lateral movement.
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
This rule detects potential internal network scanning activity by identifying a single source IP address that communicates with 15 or more distinct internal destination IP addresses within a 5-minute time window. This behavior is often indicative of reconnaissance efforts by an attacker attempting to map out the internal network.
This rule detects potential network port scanning activity by identifying a single source IP address attempting to connect to 10 or more distinct destination ports on a single destination IP address within a 5-minute window. This behavior is indicative of an attacker attempting to discover open services on a target host.
Detects instances where a web browser (Chrome, Edge, Firefox, Brave, or Internet Explorer) launches 'ms-screensketch'. This activity is unusual as browsers typically do not directly invoke system utilities like Screen Sketch. This could indicate an attempt to capture screen content, potentially for data exfiltration or reconnaissance, or an unexpected browser behavior.
Page 853 of 866