Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
8 followers9,573 downloads10,240 copies160 likes55,485 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects instances where rundll32.exe is launched by explorer.exe and includes command-line parameters indicative of network communication (http, https) or WebDAV activity (davclnt.dll, WebDAV, \\). This behavior can be associated with forced authentication attempts or execution of remote code.
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
This rule detects potential lateral movement attempts originating from IIS web servers (identified by 'w3wp.exe' as the initiating process) to other internal IP addresses using common lateral movement ports (SMB, RDP, WinRM, SSH). It specifically looks for successful network connections from an IIS server to a private IP address on one of the specified ports, where the remote IP is not the local IP.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects the command shell execution chain used by scheduled tasks to launch ransomware payloads (run.bat, run.exe) distributed via malicious GPOs
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
Page 855 of 866