Ali AlEnezi
@siteCompletionist
2 followers45 downloads259 copies6 likes5,242 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
Detects instances where Microsoft 365 Copilot surfaces content labeled with sensitivity markings to a user who only has access to that content via inherited or broad sharing permissions (e.g., Company link, Anonymous link, or inherited permissions), rather than explicit access. This identifies potential AI-retrieval exploitation patterns where Copilot inadvertently exposes sensitive information due to oversharing configurations.
Detects attempts to exploit the GitLab commits API via path traversal or direct file path manipulation to access sensitive configuration files or system secrets, such as gitlab-secrets.json, database.yml, or system files like /etc/passwd.
Detects common web application and application server processes (such as java, node, nginx, or apache) spawning suspicious shell or utility processes. This behavior is often indicative of exploitation of a web vulnerability (e.g., Remote Code Execution) where an adversary attempts to gain a reverse shell or execute post-exploitation commands.
Detects modifications to Microsoft Entra ID (Azure AD) Conditional Access policies that weaken security controls, such as disabling policies, adding exclusions, or removing MFA and compliant device requirements. The rule also alerts on deletions of Conditional Access policies and modifications occurring outside of standard business hours.
Detects attempts to exploit a path traversal vulnerability in the GitLab commits API, specifically targeting the /api/v4/projects/ repository/commits path. The rule monitors for directory traversal patterns such as .. or url-encoded variations in conjunction with file paths, which could allow unauthorized access to files outside the intended directory.
This rule monitors successful sign-in activity specifically targeting identified critical banking applications. It aggregates login counts, the number of unique users, and the unique IP addresses accessing these applications over the last 24 hours to provide visibility into usage patterns.
Detects unauthorized attempts to request an AWS token via the JFrog Artifactory API, specifically targeting a vulnerability identified as CVE-2026-42018. The rule triggers when a POST request is made to the '/access/api/v1/aws/token/' endpoint without an Authorization header, indicating potential exploitation of an anonymous token request flaw.
Detects potentially unauthorized or anomalous activations of highly privileged Entra ID roles (e.g., Global Administrator). The rule identifies activations that lack a business justification, occur during unusual hours (outside of 06:00-22:00), or exhibit burst patterns of repeated activation/deactivation cycles which may indicate automated credential abuse or persistence attempts.
This rule detects potential exploitation attempts against SonicWall SMA1000 appliances, specifically targeting the /wsproxy endpoint using a custom 'SMA Connect Agent' user agent string. This behavior is associated with SSRF vulnerabilities (CVE-2026-15409 and CVE-2026-15410) identified as being utilized by the threat actor group UTA0533 in campaigns involving INC Ransomware.
This rule detects suspicious process command-line activity on devices identified as ATMs. It looks for known malware-related executables (CSCSERVICE.EXE) and common ATM software components (DISPENSR, XFS, MSXFS, AGILIS, APTRA, PROCASH, *.xfs) being executed or initiated by unusual processes like svchost.exe, rundll32.exe, or regsvr32.exe. This activity could indicate an attempt at ATM jackpotting or other unauthorized access.
Page 1 of 8