Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,530 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects potential multi-factor authentication (MFA) fatigue attacks in Azure AD by identifying a high number of push notification MFA challenges for a single user from a specific IP address within a short time frame. Specifically, it looks for 15 or more push notification MFA challenges within a 30-minute window.
This rule detects when a single user principal name (UPN) attempts five or more sign-ins from the same IP address within a one-hour window, and each sign-in is flagged with a 'RiskDetail' other than 'none' but still results in a 'Success' status. This could indicate an attacker attempting to bypass security controls or an account compromise where the attacker is repeatedly trying to access the account from a consistent location, possibly with different credentials or methods, until successful.
Detects when a single user principal name (UPN) performs two or more Azure AD admin role assignments within an hour. This could indicate an attempt to escalate privileges or establish persistence by assigning administrative roles to multiple accounts or to the same account multiple times.
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
This rule detects instances where a user has overridden Microsoft SmartScreen warnings or bypassed Network Protection. This could indicate a user intentionally accessing potentially malicious content or an attempt to circumvent security controls.
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
Detects the execution of Windows Snipping Tool (SnippingTool.exe) or Screen Sketch (ScreenSketch.exe) when launched with the 'ms-screensketch' command-line argument. This behavior is indicative of a user or process taking a screenshot, which could be part of information gathering by an adversary.
This rule detects suspicious activity involving PowerShell downloading content (using Invoke-WebRequest, iex, or DownloadString) followed by the creation of specific suspicious files (Browser Update.exe, update.zip, update.msi) on the same device within a 10-minute window. This correlation suggests a potential ingress of malicious tools or updates.
Page 799 of 866