Goksel Atakan
@gokselatakanIstanbul, Turkiye GoXDR.fyiTrusted contributorCompletionist
0 followers35 downloads1,209 copies35 likes2,469 views
75 detections
Filters
Last updated
All Time
Detection languages
65
10
Categories
15
14
14
13
10
Platforms
28
20
16
13
13
Products / Services
16
14
11
11
8
MITRE Techniques
37
25
18
16
15
CVEs
3
2
2
1
1
Detects successful SSH connections and logons from source IPs seen in SANS ISC honeypot data for the sshole OpenSSH password authentication bypass, and lists Alpine Linux hosts that may be exposed. Alpine is not an officially supported Defender for Endpoint platform, so an empty result does not prove absence, and the long password is not visible in telemetry.
Detects evidence of the Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 supply chain compromise (SleepyDuck) in Defender XDR. Matches 21 reported SHA256 hashes in file, process and network initiator telemetry, connections to api.frameworkmetrics.xyz, the eight reported hub and relay IPs, the reported webhook.site and pastebin.com paths in URLs and command lines, the ScreenConnect relay IP and service ID in command lines, persistence paths on Linux, macOS and Windows, and the rogue ScreenConnect Client service registry key. Network and process activity from the ~/.solidity implant folder is matched regardless of destination, which keeps the hunt useful after the attacker rotates the hub address through an Ethereum contract. Lookback is 30 days. Coverage depends on Defender for Endpoint telemetry per platform, and SHA256 values are not reliably populated for non-executable files such as tgz, cjs, deb and rpm packages.
Hunts Entra ID service principal sign-ins that match reported stolen app credential abuse against MSP and customer tenants: the reported operator IP and client strings, an invalid secret followed by a successful sign-in from the same IP and apps that sign in for the first time in the window. It matches reported indicators only, so other infrastructure is not covered.
Detects PIM role activations and eligible or active role assignments that involve Entra agent users. Agents are identified by agentType, blueprintId or a maintained UPN list.
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Detects network connections to webhook.site, execution of command-line tools referencing webhook.site or ArtexProbe, and creation or writing of files associated with ArtexProbe or known webshells.
Detects network connections to the Telegram Bot API (api.telegram.org) originating from processes other than the official Telegram desktop application. Adversaries frequently abuse legitimate services like Telegram for Command and Control (C2) or data exfiltration.
Detects artifacts of the compromised litellm 1.107.0 release: connections to the exfiltration host, installs of the affected version and the dropped stealer files. Needs Defender for Endpoint network, process and file events and covers only published indicators. The query ran without errors in a live tenant.
Detects network communication to api.telegram.org from a process that is not identified as an authorized Telegram client application, potentially indicating command and control (C2) activity.
Detects SSH backdoor artifacts of a trojanized Claude Code editor extension: connections to the tunnel host, reverse SSH forwards to local port 22 and dropped persistence files. Needs Defender for Endpoint network, process and file events and covers only published indicators. The query ran without errors in a live tenant.
Detects Node.js processes spawning shells, script hosts or download tools, which is how post exploitation of a Node.js server would look after CVE-2026-111497 (Brotli decoder out of bounds write, fixed in 22.23.4, 24.22.1 and 26.12.1). Devices that Defender Vulnerability Management lists as vulnerable are flagged and sorted first, and rows are still returned when the CVE is not listed. It excludes npm, npx, yarn and pnpm processes and GitHub Actions runner action processes, which start shells for build scripts. It does not detect the memory corruption itself. The query ran without errors in a live tenant.
Page 1 of 8