Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Kubernetes Service Account Token Theft
Cortex XDR
Detects non-legitimate processes attempting to read Kubernetes service account tokens or related sensitive files (ca.crt, namespace) from the standard service account path within containers. This rule filters out common and legitimate Kubernetes system processes to reduce false positives.
Detects the creation of DaemonSets in a Kubernetes cluster using the `kubectl` command-line tool. DaemonSets are designed to run a copy of a Pod on all (or some) nodes in the cluster, making them a powerful mechanism for persistence and cluster-wide credential harvesting by attackers. This rule specifically looks for `kubectl` commands that include 'daemonset' and either 'create' or 'apply' operations.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
Detects the creation of new connectors in Power Automate (formerly Microsoft Flow) that establish connections to external services. This activity is identified by monitoring 'PutConnection' operations within PowerPlatform or MicrosoftFlow audit logs. Such an event could indicate an adversary attempting to integrate malicious services or exfiltrate data.
Detects suspicious modifications to Power Automate flow permissions, including sharing flows or changing role assignments. This could indicate a compromised account attempting to gain unauthorized access or persistence within the Power Platform environment.
Detects suspicious process execution originating from npm postinstall scripts, which can indicate a supply chain compromise. Specifically, this rule looks for npm, node, or npm.cmd processes with 'postinstall' or 'plain-crypto-js' in their command line, spawning suspicious executables like curl, wget, python, bash, sh, cmd, powershell, or wt, or connecting to known malicious domains/IPs or specific file names associated with the 'plain-crypto-js' RAT dropper.
This rule detects activity associated with TruffleHog, an open-source tool used for finding credentials and sensitive data, within cloud audit logs. It specifically looks for the 'trufflehog' string in the user_agent field, indicating that the tool was used to interact with cloud resources.
Detects the creation of known malicious Remote Access Trojan (RAT) file artifacts on Windows, Linux, and macOS systems. These artifacts are associated with the plain-crypto-js@4.2.1 NPM package supply chain compromise, which dropped RAT payloads via a postinstall script. Specifically, it looks for 'wt.exe' in '%PROGRAMDATA%' on Windows, 'ld.py' in '/tmp/' on Linux, and 'com.apple.act.mond' in '/Library/Caches/' on macOS.
Detects when an external user is invited to the Entra ID tenant. This could indicate legitimate collaboration or an attempt by an attacker to gain initial access or establish persistence by inviting a malicious external account.
Azure Suspicious Redirect URI Detection
Cortex XDR
This rule detects the modification or addition of redirect URIs for Azure Active Directory applications or service principals that point to suspicious domains. These suspicious domains include known reverse proxy/tunneling services (e.g., ngrok, cloudflare tunnel), callback infrastructure (e.g., burpcollaborator, interact.sh), or localhost/loopback addresses. Such modifications can indicate an adversary attempting to establish persistence, exfiltrate data, or redirect authentication flows to attacker-controlled infrastructure.
Page 17 of 24