Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,698 downloads10,515 copies160 likes57,270 views
8,654 detections
Filters
Last updated
All Time
Detection languages
5,826
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects outbound TCP traffic on port 443 destined for a hardcoded IP address associated with ValleyRAT C2 activity. The rule specifically monitors for established connections with a small payload size (5 bytes) that lack standard TLS handshake characteristics (no SNI), and applies a threshold to mitigate noise. This behavior is indicative of C2 heartbeats from malicious implants using DLL side-loading techniques.
Detects suspicious npm preinstall activity or node_modules execution patterns involving the execution of the Bun JavaScript runtime. This behavior is often indicative of supply chain compromise where malicious npm packages attempt to drop and run unauthorized binaries to facilitate secondary payload execution.
Detects outbound HTTP GET requests to the known malicious domain 'docsportal.in' attempting to retrieve second-stage payloads such as '161.php' or 'com.hta'. This pattern is associated with the SideCopy threat actor's malware delivery infrastructure.
Detects HTTP GET requests to Backblaze B2 storage hosting specific archive files identified as payloads for the RustyShade/RustyMove malware family, often used by the APT36 threat group.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
This rule identifies potential brute force or password spraying attacks against network edge devices, such as firewalls and VPN gateways. It aggregates authentication failures and denied connection attempts by source IP address. The rule differentiates between brute force attacks, characterized by a high volume of failed attempts against one or more users from a single source, and password spraying, indicated by multiple unique usernames failing authentication from the same source.
Detects a potential web shell deployment by identifying a web server process creating or modifying a file in common web directory locations, followed shortly (within 10 minutes) by the execution of that same file.
Detects outbound HTTP GET requests to specific GitHub repository paths hosted on raw.githubusercontent.com, which are associated with the Kimsuky threat actor's 'Operation GitPower'. These paths indicate the retrieval of malicious payloads or scripts from adversary-controlled repositories.
KQL Query from file: ClickFix – Suspicious Persistence Scheduled Task
Page 10 of 866