DL Cyber
@DanCortexUKCompletionist
0 followers0 downloads14 copies0 likes39 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
1
1
1
Platforms
1
1
1
Products / Services
1
1
1
MITRE Techniques
1
1
1
1
1
AWS Route 53 DNS Record Modification
Cortex XDR
Detects modifications to AWS Route 53 DNS resource record sets. Monitoring these changes is critical for identifying potential DNS hijacking, traffic redirection, or unauthorized infrastructure configuration changes within the AWS environment.
This rule correlates Microsoft Defender for Office 365 'Safe Links' phishing alerts, which indicate a user has clicked a potentially malicious URL. It extracts the malicious domain from the URL and aggregates multiple alert events by that domain to identify potential phishing campaigns impacting multiple users within the organization.
This rule detects successful attempts by non-approved users or service accounts to delete, patch, or update Kubernetes PrometheusRule or AlertmanagerConfig resources. These resources control critical cluster monitoring and alerting; unauthorized changes could be used to disable security monitoring, modify alert notification channels to hide malicious activity, or tamper with detection capabilities.