Frederico Canhoto
@nullwhireCompletionist
2 followers17 downloads100 copies11 likes1,326 views
7 detections
Filters
Last updated
All Time
Detection languages
7
Categories
5
2
2
1
1
Platforms
5
1
1
Products / Services
4
2
1
1
1
MITRE Techniques
3
2
2
2
2
This rule detects suspicious activity involving Azure AD device registration followed by a sign-in from the same user and IP address, particularly when the user agent strings are indicative of non-standard clients (e.g., 'node', 'axios', 'undici', 'node-fetch'). This pattern can indicate an adversary attempting to establish persistence or bypass multi-factor authentication by registering a new device and then immediately using it for access.
This rule detects suspicious activity where a user clicks on a URL from an email and subsequently accesses a '.workers.dev' domain that contains keywords commonly associated with credential harvesting or malicious activity (e.g., 'docusign', 'onedrive', 'password_reset'). This pattern often indicates a phishing attempt where an attacker uses a Cloudflare Workers domain to host a malicious landing page.
This rule detects instances where a user clicks on a URL in an email, and the final redirected URL is hosted on 'workers.dev', which is often abused for phishing campaigns, particularly OAuth device code phishing. It correlates email delivery events with URL click events and analyzes the full redirect chain to identify the final destination.
This rule detects potential DLL sideloading attempts by monitoring the loading of specific DLLs (version.dll and rtworkq.dll) from non-standard Windows system directories. It specifically looks for these DLLs being loaded by 'icardagt.exe' or 'mfpmp.exe' processes outside of 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their malicious DLLs instead of the legitimate ones.
This rule detects the creation of a suspicious file named 'spinstall0.aspx' or similar in a specific SharePoint template directory, which is indicative of a potential compromise related to CVE-2025-49704, CVE-2025-49706, or CVE-2025-53770. Additionally, it identifies network connections to known malicious IP addresses associated with these vulnerabilities.
This rule detects network connections and DNS queries to known command and control (C2) infrastructure associated with Lumma Stealer malware. It leverages a regularly updated external list of indicators of compromise (IOCs) including IP addresses and domains to identify malicious communication attempts.
This rule detects network connections or DNS queries to domains associated with the Tycoon 2FA phishing kit. The rule leverages an external data source containing a list of known malicious domains used by this phishing kit. Detection occurs if a device attempts to connect to or resolve any of these domains.