David Dvir
@BizzareC0ntactCompletionist
3 followers18 downloads59 copies6 likes942 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
2
1
1
Platforms
2
Products / Services
1
MITRE Techniques
1
1
1
1
Monitoring Chrome Extension Installs
Cortex XDR
This query detects when a new Chrome browser extension is installed on a user’s system. Monitoring browser extension installations helps identify potential security risks, such as unauthorized or malicious extensions that could collect sensitive data, alter browser behavior, or compromise user privacy.
Password Spray Using Kerberos Pre-Auth
Cortex XDR
This query detects Kerberos pre-authentication attempts where the captured source address is external.
You can tweak and remove the RFC's to also look at internal requests, but expect some noise.
In addition, you might want to tweak the counter.
You can tweak and remove the RFC's to also look at internal requests, but expect some noise.
In addition, you might want to tweak the counter.
This query uses MOTW to identify users who have downloaded files from a URI that contains an IP (eg ; https://1.1.1.1/somefile.iso)
Should always be suspicious! Tweak the extensions if you have other extensions in mind.
Should always be suspicious! Tweak the extensions if you have other extensions in mind.
This query searches for users who received a download link via a chat in MS teams or zoom and have clicked the link. (this query looks for a browser invoke to confirm)
This rule breaks Safelinks and extract the URL, and looks for suspicious extensions that are typically malicious
This rule breaks Safelinks and extract the URL, and looks for suspicious extensions that are typically malicious
Agentic AI Access to Entra
Cortex XDR
This query searches for instances where the agent type matches that of Agentic AI.
Note: This requires Azure Event Hub / Azure Ingestion. Best to run on Cortex XSIAM
Note: This requires Azure Event Hub / Azure Ingestion. Best to run on Cortex XSIAM