Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,411 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects high-privilege OAuth consent grants to applications shortly followed by suspicious mailbox modifications, such as creating new inbox or transport rules. This behavior is indicative of a post-compromise activity where an adversary uses an illicitly granted OAuth application to maintain persistence or exfiltrate data from an Exchange Online environment.
This rule monitors network device audit logs for suspicious activities that indicate potential persistence or defense evasion on edge/VPN/router appliances. It specifically flags configuration changes, creation of new administrative accounts, addition of unauthorized SSH keys, and the disabling of logging/syslog export, which are common tactics for maintainig unauthorized access on network infrastructure.
This rule detects potentially malicious activity involving Service Principals in Microsoft Entra ID. It identifies two scenarios: 1) Impossible travel, where a service principal authenticates from two distinct geographic locations within a 60-minute window, and 2) Administrative modifications to a service principal's credentials or authentication methods (e.g., adding secrets, certificates, or MFA methods), which may indicate persistence or credential abuse.
Detects host-based reconnaissance activity involving system, network, and security software enumeration using standard administrative tools (e.g., PowerShell, WMI, netsh) that is followed by an outbound network connection to a known or suspicious implant check-in endpoint within a 30-minute window.
Detects a suspicious behavior pattern where PowerShell initiates an 'msiexec.exe' process to install an MSI file located in a temporary directory, followed by that MSI process launching a secondary executable from a '%LOCALAPPDATA%\Programs\' folder. This pattern is commonly associated with malware installation or post-exploitation activities where an attacker attempts to masquerade an executable as a legitimate program.
This rule normalizes common Azure AD sign-in fields such as user principal names, source IP addresses, application display names, and authentication requirements for consistent monitoring and analysis.
This rule detects potential malicious activity where the binaries 'COTFileReadApp.exe' or 'DeElevate64.exe' initiate child processes or are themselves parent processes to suspicious binaries such as 'rundll32.exe', 'regsvr32.exe', 'msiexec.exe', 'powershell.exe', or script hosts ('wscript.exe', 'cscript.exe'). This pattern is indicative of a RAT (Remote Access Trojan) or sideloading chain dropping and executing follow-on payloads.
Detects the FileFix (ClickFix) social engineering technique, where an attacker tricks a user into pasting malicious command lines into the Windows File Explorer address bar. The rule correlates a process execution (PowerShell, Cmd, Mshta) originating from explorer.exe with recent registry writes to shell history artifacts (RunMRU, TypedPaths, or ShellBags) within a 120-second window, identifying the characteristic 'paste-and-execute' behavior.
Detects the reuse of a session or refresh token within a short timeframe (<= 900 seconds) where the source IP location, device identifier, or User-Agent string has materially changed. This behavior is indicative of Adversary-in-the-Middle (AiTM) attacks, where a session cookie has been stolen and replayed from an attacker's infrastructure to hijack a legitimate user's session.
Detects a suspicious pattern consistent with rapid handoff from an initial access broker to an operator: a user account is added to a privileged group (e.g., Domain Admins) followed within 5 minutes by successful logins to 3 or more distinct hosts. This behavior indicates immediate privilege escalation followed by rapid lateral movement.
Page 118 of 1168