Smarth Arora
@smarthxaroraToronto, ONCompletionist
1 follower243 downloads39 copies0 likes1,306 views
22 detections
Filters
Last updated
All Time
Detection languages
22
Categories
8
5
4
3
3
Platforms
11
8
5
5
3
Products / Services
6
6
4
2
2
MITRE Techniques
12
8
7
7
7
This rule detects unauthorized requests to the '/api/tokens/import/txt' endpoint, which is associated with the 'Device Code Lab' token management panel. Such activity is indicative of an attacker importing stolen session tokens to maintain persistent access to a compromised environment.
This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.
Detects indicators of Device Code Lab's PRT Refresh capability, where an administrator's 'Revoke all sessions' (revokeSignInSessions) action is followed by a prt-refresh backend call that reactivates the attacker's session without new user interaction, bypassing standard OAuth refresh token revocation.
Detects the presence of the 'x-ms-RefreshTokenCredential' cookie in requests directed to 'login.microsoftonline.com' originating from a client that does not identify as Windows. This behavioral pattern is associated with session hijacking techniques where an attacker uses a tool (e.g., Device Code Lab) to inject a session cookie into a browser, allowing for unauthorized access to Microsoft 365 services.
Detects Microsoft Graph API requests that perform bulk enumeration of email messages across multiple folders. The rule specifically identifies API queries that request sender (From) and recipient (To, CC, BCC) fields, a behavior consistent with mailbox address harvesting or reconnaissance by an Address Extractor module.
Detects an unknown/network-active parent process spawning shells used by ArachneC2 interactive shell or exec functionality.
Detects command lines consistent with ArachneC2 implant generation and hardening options.
Detects creation of ArachneC2 operator key files under the default ~/.arachne directory.
Detects the execution of PowerShell scripts located in the 'WMILoad' directory, specifically targeting 'ClockRemoval.ps1'. This script is the core AV killer component of the Dragon Boss multi-stage attack chain used to neutralize security controls.
Detects the execution of Google Chrome with the '--simulate-outdated-no-au' command-line argument. This flag is used to disable Chrome's auto-update mechanism, a technique observed being used by adware and malware, such as Dragon Boss Solutions payloads, to lock users into a modified, vulnerable browser version.
Page 2 of 3