Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
KQL Query
Detects suspicious device registrations to Azure AD's Device Registration Service (DRS) using the device code flow. This rule identifies registrations where the device OS attributes are suspicious (e.g., version 0.0.0.0) or where a non-Windows OS claims a Windows identity, potentially indicating an adversary attempting to bypass conditional access policies or gain persistent access.
Detects devices marked as 'Compliant' in Microsoft Intune despite having an implausible OS version (0.0.0.0) or 'Unknown' ownership type. This can indicate phantom device registrations where health attestation might be missing or misconfigured, leading to an incorrect 'Compliant' status instead of 'Non-Compliant'. Such devices might be used to bypass security policies or indicate a misconfiguration that could be exploited.
Detects inbound emails containing attachments with file extensions commonly used for HTML/SVG smuggling (.html, .htm, .svg, .shtml, .xhtml). This technique is often used to bypass email security filters by assembling malicious payloads client-side after the email has been delivered. The rule specifically looks for inbound emails where the attachment has not been blocked or junked by the email gateway.
This rule detects potential phishing attempts where users receive SharePoint sharing invitations or links from external tenants that are not part of the organization's trusted SharePoint environment. It identifies inbound emails from SharePoint notification senders containing URLs to external SharePoint tenants and also flags internal SharePoint sharing events (invitations or anonymous link creations) initiated by accounts whose domain differs from the home tenant. This could indicate an attacker attempting to lure users to malicious external SharePoint sites or using compromised accounts to facilitate external sharing.
KQL Query from file: T1566.003 Teams External Spearphishing with URL or Attachment Lure
This rule detects potential Conditional Access bypass attempts where a Primary Refresh Token (PRT) is exchanged for an Azure Active Directory (AAD) Graph token. The detection specifically looks for successful sign-ins to 'Windows Azure Active Directory' or 'Microsoft Graph' resources from devices marked as 'compliant' but with 'Unknown' ownership or no prior device registration history in Audit Logs. This could indicate an adversary using a compromised PRT on an unregistered or untrusted device to gain access to resources that should be protected by Conditional Access policies.
This rule detects attempts to bypass Conditional Access policies by exchanging a Primary Refresh Token (PRT) for an Azure Active Directory (AAD) Graph token on a device that is either of 'Unknown' ownership or lacks a check-in history, despite being marked as compliant. This behavior could indicate an adversary attempting to gain unauthorized access to resources by leveraging a compromised PRT on an unmanaged or suspicious device, circumventing Conditional Access controls.
KQL Query from file: Inbound Password-Protected Archive Bypassing Safe Attachments (T1566.001)
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
Page 1 of 10