Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,388 copies51 likes26,186 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Bigbear V2 Ioc Hunt
Sigma
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
This rule detects command line patterns associated with common Impacket tools (wmiexec, psexec, smbexec) executed via Windows processes (cmd.exe, powershell.exe) or via network connections to ports 445 and 135 initiated by Python processes. These tools are frequently used by adversaries for lateral movement, remote service execution, and command execution on compromised systems.
This rule monitors for interactions with known malicious files (by SHA256 hash), connections to confirmed C2 infrastructure (specific IP address and domains), or requests to known malicious URLs. It aggregates indicators across file, process, network, and web browsing telemetry to identify potential threats or compromised systems communicating with known attacker infrastructure.
This rule monitors for interactions with known malicious files (by SHA256 hash), connections to confirmed C2 infrastructure (specific IP address and domains), or requests to known malicious URLs. It aggregates indicators across file, process, network, and web browsing telemetry to identify potential threats or compromised systems communicating with known attacker infrastructure.
This rule monitors for interactions with known malicious files (by SHA256 hash), connections to confirmed C2 infrastructure (specific IP address and domains), or requests to known malicious URLs. It aggregates indicators across file, process, network, and web browsing telemetry to identify potential threats or compromised systems communicating with known attacker infrastructure.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
Detects the presence of known file hashes associated with Vectra Remote Access Trojan (RAT). The rule monitors both file creation/existence events and process execution events where the SHA256 hash matches the identified indicators of compromise.
Page 362 of 756