Jehad AbuSultan
@Jabusultan0 followers9 downloads9 copies3 likes265 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
1
1
Products / Services
1
1
1
1
MITRE Techniques
1
1
1
1
1
Detects a user password change synced from on-premises Active Directory, immediately followed by the same user registering a new MFA method. This sequence is highly suspicious for existing privileged accounts and was used by the threat actor Storm-0501 to compromise a Global Administrator account that previously lacked MFA.
This detection identifies a single MAC address rapidly appearing on multiple switch ports within a short time frame. This behavior, known as MAC flapping, is a strong indicator of a network loop, which can cause broadcast storms and degrade or disable network services.