Goksel Atakan
@gokselatakanIstanbul, Turkiye GoXDR.fyiTrusted contributorCompletionist
0 followers35 downloads1,209 copies35 likes2,469 views
74 detections
Filters
Last updated
All Time
Detection languages
64
10
Categories
15
14
13
13
10
Platforms
27
20
16
13
12
Products / Services
16
14
11
11
8
MITRE Techniques
37
25
18
16
15
CVEs
3
2
2
1
1
Detects instances where a non-browser process initiates network connections to multiple AI service providers and Discord within a 15-minute correlation window, potentially indicating automated data exfiltration or unauthorized interaction with AI platforms using tools other than standard web browsers.
Detects when an AI agent (agentic identity as identified by Entra ID agentType) is added to a group. This activity could represent legitimate provisioning of agent-based workflows, but if unexpected, it may indicate potential privilege escalation or persistence via group-based role assignments.
This rule performs a two-layer hunt for the ShieldBreak/RoguePlanet (CVE-2026-50656) exploit. Layer 1 detects potential privilege escalation by identifying Windows Error Reporting processes (WerFault, WerFaultSecure, or WerMgr) running as SYSTEM that initiate suspicious child processes like cmd.exe, powershell.exe, or rundll32.exe. Layer 2 identifies the presence of known exploit artifacts including 'ShieldBreak.exe', 'Warden.dll', and the 'eicar_com.zip' test file via process execution or file creation events.
This rule detects potentially malicious service principal activity by correlating the granting of sensitive app roles with subsequent spikes in sign-in volume. It monitors AuditLogs for 'Add app role assignment to service principal' events involving high-privilege roles, then joins this data with AADServicePrincipalSignInLogs to identify if the service principal experiences a sudden, significant increase in hourly sign-ins compared to its historical baseline within 24 hours of the permission change.
This rule identifies devices with a high concentration (5 or more) of local AI agents reported within a 30-day period. This could indicate potentially unauthorized mass deployment or misconfiguration of AI agent software on specific endpoints.
This rule analyzes recent agent telemetry to identify and summarize the distribution of local agent vendors present in the environment over a 30-day lookback period. It extracts vendor information from agent metadata and provides a frequency count to assist in auditing deployed infrastructure agents.
This rule extracts and audits inventory information from local agents, including vendor, device name, account context, and associated process information. It is designed to provide visibility into the state and configuration of installed local agents within the environment.
User All Event Log Activity
Cortex XDR
This rule monitors Windows event logs for activity involving the SAM account name, which may indicate account enumeration, credential access attempts, or malicious modifications to account security settings.
New User Creation Monitoring For On-Prem
Cortex XDR
This rule detects the creation of a new user account in Active Directory by monitoring for Windows Security Event ID 4720. It extracts the target username, target domain, and the user who performed the account creation to provide context for investigation.
This rule detects the addition of a user to a security-enabled global group in Active Directory by monitoring Windows Security Event ID 4728. This event occurs when an account is added to a security-enabled global group, which is a common action during privilege escalation or persistence phases.
Page 6 of 8