Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,421 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects the use of iam:PassRole to attach a potentially highly privileged IAM role (e.g., Administrator, PowerUser, FullAccess) to newly created or modified compute or serverless resources (EC2 instances, Lambda functions, Launch Templates, or Auto Scaling Groups). This behavior is indicative of an attacker attempting to escalate privileges by granting a managed resource excessive permissions that the attacker can subsequently abuse.
Detects the creation of programmatic API credentials or service principal keys by highly privileged cloud identities across AWS, Azure, and GCP. Specifically monitors AWS Root, Azure AD Global/Company Administrators, and GCP Organization Owners, whose roles generally do not require long-term API access.
Detects successful cloud console login events across AWS, Azure, and GCP where multi-factor authentication (MFA) was not utilized, combined with impossible travel indicators (login from different countries within an 8-hour window for the same principal).
Detects instances where a non-administrative user grants OAuth application permissions for high-risk Microsoft Graph delegated scopes. This activity is a common indicator of 'consent phishing' campaigns, where an attacker tricks a user into authorizing a malicious application, granting persistent access to the user's data and resources via API tokens, even after password resets.
Detects unauthorized modifications to federation trust configurations, such as IssuerUri, federationMetadataUrl, or signing certificate thumbprints, on a federated domain. Adversaries may manipulate these settings to establish credential-independent persistence or to forge SAML tokens (Golden SAML) by repointing the federation metadata to attacker-controlled infrastructure.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
Detects instances where an administrator has granted tenant-wide consent to an OAuth application requesting highly privileged Microsoft Graph permissions. This activity is a significant indicator of potential persistence or privilege escalation, as it allows the application to perform sensitive operations across the organization without requiring individual user interaction.
Detects when a service principal is added as an owner to an application or another service principal. This activity indicates a potential privilege escalation or persistence attempt, where a compromised application gains administrative control over other identities or resources within the Azure environment.
Detects instances where an Entra ID (Azure AD) application is registered and subsequently granted consent by the same user within 30 minutes, specifically when the activity occurs outside of typical business hours (7 AM - 7 PM) or from disparate IP addresses. This behavior pattern is indicative of potential malicious OAuth application registration and subsequent token-granting by an attacker to maintain persistent access to an environment.
Page 148 of 1168