Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,424 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mail-read or mail-write permissions, followed by the creation of a malicious inbox rule designed to forward, move, or delete sensitive email threads. This combination enables persistent exfiltration and stealth, bypassing password resets as the OAuth token remains active.
This rule detects non-interactive sign-in events using AzureAD tokens from unmanaged devices. This pattern is indicative of potential session or refresh token hijacking, where an adversary replays a stolen session token from their own environment. While a single event is not definitive for impossible travel, it serves as a high-confidence seed for identifying compromised sessions when combined with other indicators.
Detects the configuration of cross-tenant access trust policies or cross-tenant synchronization settings within an Azure tenant, specifically where inbound trust for MFA or device compliance/hybrid-join claims is explicitly enabled. This activity may indicate an adversary attempting to establish persistence or facilitate lateral movement by leveraging trusted relationships between partner organizations.
Detects anomalous sign-in activity for Azure Service Principals by comparing the current source IP/ASN and country against a 30-day historical baseline. This alert identifies potentially compromised service principals, where attackers exfiltrate secrets or certificates and attempt to authenticate from their own infrastructure.
This rule detects modifications to domain federation settings in Azure Active Directory (Microsoft Entra ID), specifically when a domain is set to federated or when critical federation URLs (IssuerUri, ActiveLogOnUri, MetadataExchangeUri) are changed. Such modifications can indicate an attempt to establish malicious domain federation, allowing an adversary to authenticate as any user within the tenant.
This rule detects modifications to domain federation settings in Azure Active Directory (Microsoft Entra ID), specifically when a domain is set to federated or when critical federation URLs (IssuerUri, ActiveLogOnUri, MetadataExchangeUri) are changed. Such modifications can indicate an attempt to establish malicious domain federation, allowing an adversary to authenticate as any user within the tenant.
Detects instances where a user grants consent to an Azure AD application with highly sensitive permissions (such as ReadWrite access to Directory, Roles, or Applications). This pattern is commonly used in OAuth consent phishing attacks to maintain persistence or escalate privileges by authorizing a malicious application to act on behalf of the user or the entire directory.
No description available.
No description available.
This rule detects modifications to multi-factor authentication (MFA) settings performed by privileged users (e.g., Global Admins) from IP addresses not previously associated with their account. The rule tracks actions such as registering new security information, changing default MFA methods, or deleting authentication methods. High-risk indicators like an unknown IP address for a privileged account are flagged for further investigation.
Page 156 of 1168