Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Duo MFA Push Fatigue Activity
Cortex XDR
Detects a suspicious burst of multi-factor authentication (MFA) push request denials (such as user cancellations or ignored requests) originating from a single user within a short time window. This behavior is indicative of MFA fatigue, where an attacker repeatedly triggers MFA requests in an attempt to annoy or trick the legitimate user into inadvertently approving a push notification.
Detects the execution of Chromium-based browsers (Chrome, Edge, Brave, Chromium) using command-line arguments '--load-extension' or '--disable-extensions-except'. These flags are typically used for development purposes but are abused by attackers to sideload malicious, unpacked extensions, bypassing the browser's extension store review process and enabling techniques such as credential theft or C2 persistence.
Slack Anomalous Activity
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that Slack identifies. The rule extracts relevant user and context information for further investigation.
This query performs comprehensive field extraction and normalization on SentinelOne Deep Visibility raw logs. It acts as a parsing and preparation layer to structure diverse event categories (process, network, file, registry, authentication, and task events) into a standardized format for security analysis, triage, and threat hunting.
This rule detects when common web browser processes spawn command-line shells or scripting interpreters. This behavior is often indicative of malicious browser extensions, browser exploitation, or remote code execution attempts, as browsers generally should not be launching native system shells.
This rule detects modifications to Azure Service Principal and Application object redirect URIs that match known patterns for reverse proxies, tunneling services, temporary callback infrastructure, or potential local token theft. Such changes may indicate an adversary attempting to establish persistent access, intercept authentication tokens, or bypass network controls via unauthorized application configurations.
This rule monitors Okta system logs for lifecycle events related to inbound Identity Providers (IdP), specifically creation, modification, activation, deactivation, or deletion. It flags these changes when initiated by clients identified as proxies or associated with known abused ASNs. This activity is indicative of potential cross-tenant impersonation where an attacker with administrative access adds a malicious IdP to federate and impersonate organizational users.
Detects high volumes of authentication failures within Okta, characterized by a single source IP address targeting a large number of distinct user accounts. This behavior is indicative of automated credential attacks, such as password spraying or credential stuffing, designed to discover valid credentials or exploit reused passwords while attempting to evade account lockout thresholds.
Entra ID Device Registration Event
Cortex XDR
Detects device registration events within Entra ID. Attackers may register their own device to a compromised account to maintain persistent access or satisfy device-compliance conditional access policies.
Detects outbound network connections to identified infrastructure associated with 'Pink' (CL-CRI-1147) passkey-enrollment vishing campaigns. These operators use phone-based social engineering to direct victims to phishing domains that relay credentials and MFA tokens in real-time to register attacker-controlled passkeys. The rule monitors for specific DNS query patterns containing passkey-related keywords and known malicious IP addresses used by the threat group.
Page 10 of 24