Mehulkumar Savajani
@MsavajaniCompletionist
5 followers477 downloads1,508 copies62 likes18,115 views
97 detections
Filters
Last updated
All Time
Detection languages
80
11
6
Categories
24
23
17
16
14
Platforms
53
16
13
12
6
Products / Services
24
9
8
7
6
MITRE Techniques
28
27
26
21
20
Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.
Detects a high volume of Microsoft Teams invitation emails sent to multiple users within the organization. This could indicate a reconnaissance attempt or a widespread phishing campaign where an attacker is trying to lure users into a malicious external tenant, bypassing some internal security controls.
Detects when a Microsoft Teams messaging policy is modified to allow users to send B2B invitations to external users ('UseB2BInvitesToAddExternalUsers' set to 'True'). While this can be a legitimate administrative change, it can also be an indicator of misconfiguration or malicious activity to enable phishing attacks by luring users to malicious external tenants where organizational security controls do not apply.
Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.
Detects a pattern indicative of an NTLM relay attack following an authentication coercion spray. The rule first identifies a single source IP generating a high volume of failed NTLM logon attempts across multiple critical servers in a short time. It then looks for a subsequent successful NTLM logon from that same source IP to a high-value target (like a Certificate Authority) using a machine account. This sequence is a strong indicator that an attacker coerced credentials and is now relaying them to escalate privileges.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects the execution of legitimate or dual-use tools commonly used by the CL-CRI-1040/Storm-2603 actor for post-exploitation activities like credential dumping, reconnaissance, and lateral movement. The rule attempts to reduce false positives by looking for execution from unusual paths or by suspicious parent processes.
This rule detects the creation or modification of a GitHub Actions workflow file named 'discussion.yaml' within the '.github/workflows/' directory. This is a known persistence technique used by the Shai-Hulud 2.0 worm to register an infected machine as a self-hosted runner, allowing attackers to execute arbitrary commands.
Detects the attachment of a virtual disk (.vmdk) likely belonging to a Domain Controller to another virtual machine. This technique is used by threat actors like SCATTERED SPIDER to access the Active Directory database (ntds.dit) for offline credential dumping. This is often done on a newly created, attacker-controlled VM.
Detects network connections originating from notepad.exe to suspicious domains or IP addresses. This is a high-fidelity indicator of compromise associated with the SERPENTINE#CLOUD campaign, where a malicious payload is injected into the notepad.exe process for C2 communications.
Page 6 of 10