Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
This rule detects potential GraphRunner activity in Azure environments by identifying suspicious authentication attempts to Microsoft Graph using the 'deviceCode' authentication protocol, combined with specific user agent strings associated with the GraphRunner tool. It categorizes detections into high confidence (both device code and suspicious user agent), device code authentication only, or suspicious user agent only.
AWS Region Enablement Detection
Cortex XDR
Detects when a commonly abused or dormant/opt-in AWS region is enabled in an account. Adversaries may enable unused AWS regions to evade detection, deploy resources for malicious activities like cryptocurrency mining, or to establish persistence outside of actively monitored regions.
Azure Blob Anonymous Access
Cortex XDR
Detects unauthenticated or anonymous access attempts to Azure Blob Storage. This rule identifies successful operations where the identity is explicitly listed as 'anonymous', indicating potential misconfigurations or unauthorized access to sensitive data.
Azure Impossible Travel Detection
Cortex XDR
Detects an identity signing in from two or more distinct geolocations within a one-hour window in Azure, indicating potential impossible travel activity.
This rule detects the installation of suspicious extensions on Azure Virtual Machines. These extensions, such as CustomScriptExtension, RunCommandHandler, DSCExtension, AADLoginForWindows, and NetworkWatcherAgent, can be abused by attackers for various purposes including remote code execution, configuration manipulation, unauthorized account access, or network reconnaissance. Monitoring their installation can help identify potential compromise or malicious activity within an Azure environment.
Large Azure Blob Downloads
Cortex XDR
Detects an identity downloading an unusually high number of blobs (more than 100) from Azure Storage within a one-hour window. This could indicate data exfiltration or unauthorized bulk access to cloud storage.
This rule detects unusual access patterns to Azure resources where a single identity (user or service principal) accesses resources from multiple distinct IP addresses and/or geographic locations within a 7-day timeframe. This behavior can indicate compromised credentials, session hijacking, or an adversary attempting to evade detection by frequently changing their apparent origin.
Detects a single Azure identity accessing three or more distinct Azure resource types within a short time window. This behavior can indicate an attacker attempting to enumerate or pivot through an environment after compromising an identity.
Detects suspicious child processes spawned by gup.exe, which is the Notepad++ updater. This behavior can indicate an attempt to hijack the update process for malicious purposes, such as executing arbitrary code or installing unwanted software. The rule specifically looks for gup.exe spawning common scripting/execution tools (update.exe, AutoUpdater.exe, curl.exe, cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe) or processes from temporary or user application data directories, while excluding legitimate explorer.exe and Notepad++ installer processes.
Detects the execution of 'finger.exe' or 'ct.exe' with command-line arguments indicating an attempt to start 'cmd.exe', correlated with network connections to a known malicious IP address (69.67.173.30). This behavior is indicative of LOLBIN (Living Off the Land Binaries and Scripts) abuse for command and control communication.
Page 20 of 24