Anoozilla HunterX
@AnoozillaHunterX3 followers354 downloads98 copies11 likes1,828 views
11 detections
Filters
Last updated
All Time
Detection languages
11
Categories
4
3
2
2
2
Platforms
4
3
2
2
1
Products / Services
3
2
2
2
2
MITRE Techniques
4
3
2
2
2
Query sign-ins with MFA success immediately following multiple failed sign-ins from different regions. Potential session hijack or AiTM (Adversary-in-the-Middle).
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
* Compare distances and times of consecutive sign-ins for the same user.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
This rule detects a high volume of DNS queries (over 50) from a single source IP to a limited number of destination IPs (2 or less) for non-standard domains. It excludes common legitimate domains like microsoft.com, google.com, apple.com, cloudflare.com, akamai.com, and amazonaws.com, as well as queries to private IP ranges. This pattern can indicate DNS tunneling, data exfiltration, or command and control activity.
Detects the creation of a PHP web shell file named 'hafuab.php' in '/usr/local/webui/' by an 'echo' command, which includes PHP code to display 'test - Open source project (github.com/test/test)' and 'phpinfo()'. This activity is indicative of an attacker attempting to establish persistent access and gain information about the web server environment.
This detection identifies when a file is created or modified on a host within a short time window after a USB storage device was inserted. This behavior can be indicative of malware spreading via removable media, where a payload is automatically dropped onto the system.
Detects suspicious command-line activity associated with the "ClickFix" social engineering technique.
Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads.
This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.
Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads.
This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.
This rule detects attempts at Local File Inclusion (LFI) or Remote File Inclusion (RFI) vulnerabilities by analyzing web server logs for specific patterns in the request URI. It looks for directory traversal sequences ('../'), attempts to access common sensitive files like '/etc/passwd', or patterns indicating file inclusion via HTTP or file:// protocols.
This rule detects potential proxy bypass attempts by identifying network connections on common web ports (80, 443) that are allowed by the network firewall but do not appear in the proxy logs. It correlates network traffic from the Network_Traffic data model with proxy traffic from the Web data model. The rule specifically filters for external-bound traffic by excluding private and multicast IP addresses.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
This detection identifies attempts to delete volume shadow copies using common utilities like vssadmin, wmic, or PowerShell. This is a technique frequently used by ransomware before encryption to prevent easy restoration of files.
Page 1 of 2