Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,698 downloads10,515 copies160 likes57,271 views
8,654 detections
Filters
Last updated
All Time
Detection languages
5,826
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects anomalous SOAP requests to the SharePoint WebPartPages.asmx endpoint specifically targeting the 'GetWebPartPageConnectionInfo' method. This pattern is associated with exploitation attempts against SharePoint vulnerabilities.
Detects the loading of the known vulnerable GIGABYTE driver (gdrv.sys) on Windows systems. Attackers leverage this driver as part of Bring Your Own Vulnerable Driver (BYOVD) attacks to perform privilege escalation by exploiting kernel-mode vulnerabilities.
Detects unauthorized or external access attempts to the Ollama LLM API service (TCP port 11434). The rule specifically flags POST requests targeting the /api/generate or /api/chat endpoints, which are commonly exposed via misconfiguration or lack of authentication, potentially allowing remote command execution or model exploitation.
Broad triage/hunting rule to surface all requests to the j_security_check authentication endpoint on Cisco Catalyst SD-WAN Manager, in support of investigating CVE-2026-76504 (unauthenticated admin auth-bypass zero-day). Cisco advises reviewing serviceproxy-access.log and vmanage-server.log for requests to this endpoint from unknown or unauthorized source IPs. This rule matches ANY request to the endpoint and is NOT itself evidence of compromise -- every match requires manual review of source IP legitimacy against known/authorized administrative addresses.
This rule identifies installations of TeamViewer software that are vulnerable to specific CVEs (CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92370, CVE-2026-92371) by analyzing the 'DeviceTvmSoftwareInventory' dataset. It checks for versioning patterns against known vulnerable build numbers across Windows, Linux, and macOS platforms to pinpoint systems requiring patching.
This rule monitors for various indicators of compromise (IOCs) including malicious domains, IP addresses, specific URI paths, file names, and file hashes. It aggregates telemetry from network, file, process, and certificate events to detect potential threats interacting with known bad infrastructure or executing suspicious files associated with malware campaigns.
Detects an exploitation attempt against PaperCut MF software leveraging SQL injection to deliver a Java bytecode loader (identified by the 'cafebabe' magic bytes) via a POST request.
Detects sign-in attempts originating from IP address ranges known to be utilized by the TeamFiltration tool for password spraying operations against Azure environments.
KQL Query
This rule performs a point-in-time IOC hunt within CommonSecurityLog data to detect indicators associated with NeedyMantis. It monitors for specific C2 infrastructure domains ('tripswithengine.com') and a hardcoded user-agent string ('Firefox/21.0') in proxy, firewall, or network logs, which are characteristic of this threat actor's activity.
Page 12 of 866