Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Detects mass revocation of OAuth tokens by a user, which may indicate an attacker cleaning up evidence after data extraction, or legitimate administrative incident response activity.
This rule detects instances where a process that is not a recognized web browser attempts to access sensitive files associated with browser credential stores, such as Login Data, Cookies, and web browser state files. Such activity is commonly associated with infostealer malware, which attempts to exfiltrate saved passwords, session cookies, and autofill information.
Detects user account lockouts or instances where a user has been flagged for frequent failed authentication attempts within the Duo Security platform. This activity is indicative of brute force attacks, credential stuffing, or attempts to bypass Multi-Factor Authentication (MFA) via fatigue or repeated request generation.
Detects unauthorized modifications to Windows Registry keys responsible for forcing browser extensions. Attackers often abuse 'ExtensionInstallForcelist' and related policy keys in Google Chrome, Microsoft Edge, or Brave to silently install malicious extensions for persistence or credential theft. This rule flags modifications performed by processes other than known system administration or GPO management tools.
Detects MFA authentication attempts in Duo where the source IP address is identified by Duo as a known anonymous proxy, VPN, or Tor exit node. Such infrastructure is frequently used by adversaries to mask their true origin during credential stuffing, session hijacking, or post-compromise activity.
Detects anomalous OAuth application authorization behavior by a user, specifically monitoring for a spike in authorization events within a short timeframe. This activity is often indicative of consent phishing campaigns where an adversary tricks a user into granting excessive application permissions to a malicious OAuth app, or a compromised account performing bulk authorization grants.
Detects the use of sts:AssumeRoot within an AWS Organization. This action allows an entity within the management account to assume root-level access in a member account, effectively bypassing standard IAM restrictions. This is a high-risk event indicative of potential privilege escalation or management account compromise.
This rule detects instances where a user has explicitly marked an MFA push notification as fraudulent within the Duo Security platform. This indicates that an unauthorized party may have triggered an MFA request using stolen credentials, and the legitimate user is actively denying the authentication attempt.
Detects instances where a user who has not enrolled in Duo MFA successfully authenticates due to being connected to a defined trusted network. This behavior indicates an MFA coverage gap, potentially allowing an attacker to authenticate as an unenrolled user without MFA if they gain access to a trusted network or VPN.
Detects modifications to the 'msDS-KeyCredentialLink' attribute on user or computer objects within Active Directory. This attribute is targeted in 'Shadow Credentials' attacks (e.g., using tools like Whisker, pyWhisker, or DSInternals) to add an attacker-controlled public key, allowing for PKINIT-based authentication as the victim account without knowing the password.
Page 9 of 24