Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
Detects high-volume Microsoft Graph API and SCIM endpoint enumeration consistent with employee directory scraping, potentially by threat groups like BlackFile/Cordial Spider. This rule identifies suspicious activity based on a high count of directory queries or distinct URIs accessed within a short time frame, originating from non-Microsoft/Google/Amazon/IBM ASNs and using common scripting/API user agents.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, specifically targeting behaviors associated with threat groups like BlackFile and Cordial Spider. The rule identifies these activities by filtering Okta SSO raw logs for specific event types related to MFA and device management, and then correlating them with known proxy ASN organizations or Okta's internal proxy flags.
Inbox Rule Notification Suppression
Cortex XDR
Detects the creation or modification of inbox rules designed to hide security and MFA notifications by deleting, marking as read, or moving them to hidden folders. This technique is commonly used post-compromise to suppress alerts about rogue device enrollment, sign-ins, or password changes, preventing the victim from discovering an account takeover. It is a frequent persistence technique in Business Email Compromise (BEC) and Account Takeover (ATO) attacks.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window. This behavior can indicate data exfiltration or collection by an adversary.
This rule detects programmatic file downloads from SharePoint and OneDrive using various automation tools and SDKs, rather than typical browser access. It specifically looks for `FileDownloaded`, `FileSyncDownloadedFull`, `FileAccessed`, or `FilePreviewed` operations within SharePoint or OneDrive audit logs where the user agent string indicates the use of PowerShell, PnP, Microsoft Graph SDK, Python, Node.js, or common command-line tools like curl or wget. This behavior can be indicative of data exfiltration.
Detects regsvr32.exe loading DLLs from user-writable directories such as Temp, AppData, ProgramData, Downloads, Desktop, and Public. Legitimate DLL registration runs from System32 or Program Files - execution from these paths indicates LOLBin abuse for proxy execution, DLL sideloading, or defense evasion commonly used to launch malware payloads.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to establish persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Okta Impossible Travel Detection
Cortex XDR
Detects when a single user successfully authenticates to Okta from two different countries within a two-hour window, indicating potential impossible travel which could be a sign of a compromised account.
This rule processes Microsoft Graph Security Alerts, aggregating evidence from various Microsoft Defender products (MDE, MDI, MDCA, MDO, Entra ID Protection). It extracts and normalizes detailed evidence related to devices, users, IP addresses, processes, files, URLs, emails, mailboxes, network connections, and Azure resources, providing a comprehensive view of security incidents across the Microsoft ecosystem.
Page 12 of 24