Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,698 downloads10,515 copies160 likes57,270 views
8,654 detections
Filters
Last updated
All Time
Detection languages
5,826
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects Impacket-style lateral movement patterns where system processes such as services.exe or wmiprvse.exe spawn command shells to copy files from a network share (UNC path) and execute them. This rule specifically looks for evidence of staging binaries or DLLs from remote shares, which is a common behavior of post-compromise frameworks like Impacket when performing 'hands-on-keyboard' actions.
This rule detects potential brute-force activity against remote access services (OpenVPN, StrongSwan, WireGuard, and SSH) on Linux hosts by monitoring Syslog for patterns indicating repeated failed authentication attempts. It further highlights instances where a burst of failed attempts is followed by a successful authentication for the same source IP, indicating a potential successful compromise.
Detects the creation of web shell-consistent files (.jsp, .jspx, .php, .cgi) within sensitive web application directories on Cisco Firepower Management Center (FMC) appliances. This rule is designed to identify potential post-exploitation activity associated with the authentication bypass vulnerability CVE-2026-20079, which has been observed being used by various threat actors to deploy web shells.
Detects VPN/IKE negotiation failures characterized by certificate validation or parsing anomalies on Check Point Security Gateway or Spark firewall devices. These anomalies, when correlated with connections originating from known anonymization infrastructure (such as Tor exit nodes, proxies, or public VPN services), indicate potential exploitation attempts of the CVE-2026-85102 vulnerability, which allows for pre-authentication remote code execution via malformed certificate inputs.
Detects the execution of a Node.js interpreter (node.exe or node) as a child process of a Fortinet management-related process, or where the command line contains references to Fortinet. This behavior is indicative of post-exploitation activity related to CVE-2025-25249, where a heap-based buffer overflow is exploited to deploy the PivotC2 remote access trojan.
Detects HTTP requests containing common web exploit patterns (SQLi, XSS, RCE) that exhibit characteristics of automated, mutating payload generation often utilized in AI-assisted fuzzing or vulnerability scanning tools. The rule monitors for encoded, obfuscated, or highly varied payload syntax within URI query strings.
This rule monitors for a rapid sequence of TCP SYN packets directed towards common administrative ports (SSH/22, RDP/3389, SMB/445) within a short window, indicative of an automated lateral movement scanning attempt or a brute-force discovery phase originating from within the internal network.
This rule detects external reconnaissance attempts targeting MLflow Tracking Servers by monitoring for inbound HTTP GET requests to the default MLflow API path '/api/2.0/mlflow/'. This behavior is indicative of an adversary scanning for exposed machine learning infrastructure, potentially to facilitate subsequent unauthorized access or exploitation of the tracking server.
Detects multiple attempts to connect to administrative shares (ADMIN$, C$, IPC$) from a single source within a 60-second window. This pattern is indicative of automated lateral movement or enumeration attempts using the SMB protocol.
This rule detects potential unauthorized Remote Monitoring and Management (RMM) tool installation activities. It looks for common patterns used by adversaries to deploy RMM agents, including silent MSI installations from HTTPS URLs, batch/VBS scripts performing administrative privilege checks prior to silent execution, and PowerShell commands utilizing 'Start-Process' with elevated privileges to download and execute files from the internet.
Page 16 of 866