Rohan Taluja
@cypher01Completionist
0 followers7 downloads13 copies0 likes1,529 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
2
1
Platforms
2
1
Products / Services
1
MITRE Techniques
2
2
1
1
1
Detects if a new connector is registered on Azure AD; Azure AD Application Proxy is a feature of Microsoft Entra that allows you to securely publish on-premises applications to remote users. This is particularly useful for organizations that need to provide access to internal applications without exposing them directly to the internet.
Detects potential impossible travel activity by comparing location data
Detects command line execution attempting to modify fDenyTSConnections registry value via reg add — used by attackers to enable RDP for lateral movement
Detects registry modification to fDenyTSConnections — used to enable or disable Remote Desktop access. Attackers modify this value to enable RDP for lateral movement or persistent remote access