Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,387 copies51 likes26,185 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects an administrator account rapidly granting mailbox permissions (Add-MailboxPermission, Add-RecipientPermission, Set-MailboxFolderPermission) to a large number of objects within a short timeframe (15 minutes). The rule correlates this activity with a prior 'risky' sign-in or a sign-in using device-code flow, indicative of potential EvilToken or similar adversary-in-the-middle proxy-based session hijacking.
Page 345 of 756