A’Keem Gurley
@MFA_meexCompletionist
0 followers1 download96 copies3 likes1,601 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
2
2
2
1
1
Platforms
4
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
3
2
1
1
1
Detects potential “HashJack” prompt injection attempts in AI tool activity. This technique, known as HashJack, attempts to manipulate AI models by hiding instructions after the '#' in a URL. The rule specifically looks for URLs within submitted prompts that contain fragments with suspicious keywords indicative of prompt injection, such as "ignore previous", "override instructions", "system prompt", etc.
Detects multiple multi-factor authentication (MFA) attempts that are denied or ignored by a user beyond a defined threshold within a specific lookback window. This behavior is indicative of an MFA fatigue attack, where an adversary repeatedly sends MFA requests to a user in hopes they will eventually approve one to stop the annoyance.
Detects potential password spray activity by identifying a single IP address generating failed sign-ins across multiple distinct user accounts within a short window. This rule specifically looks for '50126' result type, indicating an invalid username or password, from a single IP address attempting to authenticate against at least 5 distinct user accounts within a 10-minute window.
Detects when a user grants consent to an application that has not been seen in the environment before. This rule baselines known applications over a 30-day period and alerts on any new application consent grants or service principal additions within the last day that are not part of the baseline or an explicit allow list.
This rule identifies the creation or deletion of user accounts in Azure AD (Entra ID) by principals not on an approved list. It relies on a customized list of approved administrators/service principals to reduce false positives.
Detects common shell or script processes spawned by explorer.exe, which may indicate execution via the Windows Run dialog. This behavior aligns with ClickFix social engineering techniques and checks for suspicious command-line arguments tied to this pattern, often used to download or execute malicious code.