Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Detects a near-simultaneous correlation between a user registering a new FIDO2 authentication method and a login session from an unmanaged or non-compliant device. This behavioral pattern is often associated with adversary-in-the-middle or vishing attacks where an attacker tricks a user into registering an attacker-controlled security key to maintain persistent MFA access.
Detects the modification of an existing IAM role's trust policy to include new trusted principals (external AWS accounts, root principals, or wildcards). This technique is used for persistence and privilege escalation by modifying existing roles to allow access by an attacker-controlled principal, effectively bypassing detections focused on the creation of new roles.
Detects anomalous NTLM authentication activity (LogonType 3) where a single account or source IP attempts to authenticate to 25 or more unique hosts within a 10-minute window. This behavioral pattern is frequently observed during credential spraying, pass-the-hash attacks, or unauthorized lateral movement attempts using NTLM.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. UNC6692 ("Snow Flurries") impersonates IT helpdesk over Teams, lures victims to a fake "Mailbox Repair Utility" page, and delivers a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects potentially unauthorized data exfiltration or bulk extraction activities within Google Cloud BigQuery. The rule monitors for large-scale data queries (SELECT * or queries without filters), data exports to external Google Cloud Storage buckets, and queries executed by automated scripts or tools, which are common indicators of staged data theft following cloud environment compromise.
Detects modifications to Google Cloud IAM policies where permissions are granted that allow service account impersonation or key management (e.g., serviceAccountTokenCreator, serviceAccountKeyAdmin, workloadIdentityUser, serviceAccountUser). These roles are frequently abused by attackers to gain durable, persistent access or escalate privileges by generating tokens as highly-privileged service accounts without requiring an existing service account key.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects the creation of Google Cloud Dataflow jobs that exhibit indicators of malicious data exfiltration pipelines, such as usage of suspicious job names (common with exfiltration tools), service account delegation, or execution via scripted user agents.
GCP Service Account or Key Creation
Cortex XDR
Detects the creation of Google Cloud Platform (GCP) service accounts or service account keys. Service account keys provide long-lived, programmatic access to cloud resources that persist beyond password resets or MFA requirements, making them a common target for attackers looking to maintain persistence, conduct lateral movement, or escalate privileges within a GCP environment.
This rule detects suspicious activities related to OAuth application consent and service principal operations originating from proxy infrastructure. Specifically, it looks for actions such as adding service principal credentials, granting OAuth2Permission, consenting to applications, adding delegated permission grants, or adding new service principals/applications, where the initiating IP address is identified as belonging to a proxy service. This combination of activities and source IP can indicate an adversary attempting to establish persistence or escalate privileges within an Azure AD environment.
Page 11 of 24