Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,421 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects when high-privilege application permissions (e.g., Directory.ReadWrite.All, Application.ReadWrite.All) are granted to a service principal via admin consent. This behavior can be used by attackers to gain persistent, stealthy administrative access to a Microsoft Entra ID tenant.
Detects modifications to Entra ID (Azure AD) cross-tenant access settings, including inbound/outbound trust settings and B2B collaboration configurations. This activity may indicate an adversary attempting to establish persistence or facilitate unauthorized access by creating a trust relationship with an external tenant they control.
Detects modifications to Entra ID (Azure AD) cross-tenant access settings, including inbound/outbound trust settings and B2B collaboration configurations. This activity may indicate an adversary attempting to establish persistence or facilitate unauthorized access by creating a trust relationship with an external tenant they control.
This rule detects when a user or admin grants consent to an unverified OAuth application that simultaneously requests sensitive delegated permissions across multiple categories (Mail, Files, Directory, and Contacts). This pattern is a strong indicator of consent phishing attacks, where adversaries trick users into granting broad permissions to a malicious application to harvest sensitive data or gain persistent access to a Microsoft 365 environment.
Detects anomalous Privileged Identity Management (PIM) role activations in Entra ID that deviate from standard patterns. This includes instances where roles are activated without required approvals, for unusually long durations, or when an account activates multiple distinct roles within a short time frame, potentially indicating account takeover or abuse of standing privileges.
Detects non-interactive Microsoft Entra ID service principal or managed identity sign-in events originating from an IP address, ASN, or country that has not been historically associated with that specific service principal. This behavior may indicate the use of compromised service principal credentials or stolen access tokens from adversary-controlled infrastructure.
Detects unauthorized changes to the token-signing certificate for federated domains in Microsoft Entra ID (formerly Azure AD). This behavior is often associated with the Golden SAML attack technique, where an adversary modifies federation settings to forge authentication tokens. The rule filters for events occurring outside of standard business hours and alerts when the modification is not performed by known automation service accounts.
Detects the registration of a new multi-tenant OAuth application in an enterprise cloud environment that requests high-risk scopes (e.g., mail access or directory write permissions). This behavior is often associated with OAuth-based consent phishing or the establishment of persistent backdoors in cloud environments.
Detects the registration of a new multi-tenant OAuth application in an enterprise cloud environment that requests high-risk scopes (e.g., mail access or directory write permissions). This behavior is often associated with OAuth-based consent phishing or the establishment of persistent backdoors in cloud environments.
This rule detects when a Service Principal or Application is assigned to highly privileged directory roles within Microsoft Entra ID (formerly Azure AD). Adversaries may perform this action to achieve persistence or escalate privileges within the cloud environment by granting high-level administrative access to a compromised or adversary-controlled service principal.
Page 146 of 1168