Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
91 detections
Filters
Last updated
All Time
Detection languages
59
31
1
Categories
33
18
15
14
9
Platforms
57
13
9
6
5
Products / Services
13
12
6
6
6
MITRE Techniques
38
26
26
24
23
Identifies HTTP requests containing the custom 'X-Antibot-Token' header used by the EvilTokens phishing kit to validate interactions and evade automated scanners. This header is highly specific to the EvilTokens PhaaS and its presence indicates malicious activity.
Identifies network traffic targeting the backend API endpoints associated with EvilTokens device code generation and token weaponization. This rule specifically looks for requests to paths like /api/device/start, /api/device/status, /api/device/sessions, and various /api/prt/ endpoints (convert, refresh, exchange, cookie, owa-session, recon, azure) which are indicative of EvilTokens activity.
Detects the creation of the WindowsVaultSyncService scheduled task or a task using the specific misleading description observed in SHEETCREEP (APT36) infections. The malware uses the Task Scheduler COM API to establish persistence.
Detects access to the Intune admin portal from devices that are not marked as compliant or lack a device ID. This may indicate potential credential theft, session replay from unmanaged infrastructure, or AiTM phishing proxies bypassing basic MFA.
Detects the creation of a new Global Administrator or Company Administrator account in Microsoft Entra ID (formerly Azure Active Directory). Adversaries may escalate privileges from compromised MDM administration roles (like Intune) to Entra ID Global Admin to cement full control over the tenant.
Detects the specific command-line sequence utilized by the SHEETCREEP dropper to delete itself (melt) and hide forensic traces using cmd.exe. This involves a delayed deletion using 'choice' and 'del /f /q' commands.
Detects successful device code flow sign-ins to the Microsoft Authentication Broker application targeting the Microsoft Graph resource, specifically when the sign-in does not originate from a trusted named location. This activity can indicate a device code phishing attempt where an attacker tricks a user into authenticating a malicious application.
Detects successful sign-ins to Microsoft Office applications using the device code flow (FOCI AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that originate from an untrusted network location. This activity can indicate a device code phishing attack where an adversary has tricked a user into authenticating a malicious application.
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
Detects a successful login from a non-compliant, unmanaged device followed by an inbox rule creation or modification within 10 minutes. This sequence aligns with post-compromise evasion tactics observed in device code phishing campaigns like Kali365, where attackers quickly suppress security alerts after gaining access.
Page 2 of 10