Riley Havill
@RileyHV1 follower44 downloads88 copies11 likes10,511 views
11 detections
Filters
Last updated
All Time
Detection languages
11
Categories
1
1
1
1
1
Platforms
4
Products / Services
3
MITRE Techniques
3
2
2
1
1
This rule detects when a high number of downloads have been performed by a user from SharePoint. This could indicate an insider threat collecting data before sending it outside of the company.
This detection looks for cases where a user has downloaded an attachment from 3 or more separate emails over a 24 hour period. This activity could indicate an insider risk collecting documents prior to data exfiltration.
The limit for this can be altered based on baseline company behaviour.
The limit for this can be altered based on baseline company behaviour.
This detection looks at users attempting to download files from the internet using powershell / cmd commands. It measures the number of commands against a baseline set over the past 14days and if a user has performed an unusual amount of commands (also more than 5) then an alert will be created. This will detect when an attacker has compromised a user and is now attempting to download payloads from the internet or a C2.
This detection looks at emails being sent from a users company email address to their personal email through comparing the sender and recipient email addresses to see if they contain similar strings. Users who are close to leaving the company and working their notice period etc should be monitored more closely and an increased number of emails being sent to a personal email can indicate data exfiltration.
This detection looks for external guest accounts being added to a company EntraID, where the external guests target resource does not contain the company domain. This activity can indicate compromise and now the threat actor is looking to maintain persistence through the creation of accounts.
This detection looks for emails which include URLs with ‘amp/s’. This is an indicator of Google AMP Phishing which uses legitimate Google domains to redirect to the malicious URLs. When detected this is a high confident sign of phishing.
An attacker knows a users login credentials for an account with MFA enabled. The attacker overloads the user with MFA requests hoping the user will accept one of them. This detection looks for a successful MFA completion that follows a stream of failed MFA requests within the past hour.
A Google Workspace user is attempting to download, print or email as an attachment a suspicious amount of files over a short time period. This can indicate an attacker trying to exfiltrate data.
An attacker has gained access to internal systems, and is now closing large amounts of tickets to cover their tracks. This could indicate account compromise, especially if paired with alerts for logins from new IP addresses or a successful login after a brute force attack. By identifying an influx of closed tickets
This alert indicates that a user has successfully passed MFA after a stream of login failures. This activity may indicate that an attacker has successfully brute forced an accounts credentials and has passed MFA.
Page 1 of 2