Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,430 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a rapid burst of read-only IAM and STS API enumeration calls originating from a single source IP address within a one-minute window. This behavior is indicative of automated reconnaissance tools (e.g., enumerate-iam, Pacu) used in the early stages of a cloud attack to identify permissions and potential targets for privilege escalation.
Detects anomalous authentication patterns where a user account accesses a large number of distinct SaaS/SSO resources within a short time frame from devices or IP addresses not previously associated with the user's historical baseline. This behavior is indicative of a stolen session cookie being replayed by an adversary to perform rapid lateral movement across the victim's cloud footprint.
Detects the granting of high-risk OAuth application scopes (e.g., Mail.Read, offline_access) within two hours of a risky sign-in event for the same user. This pattern is indicative of attackers establishing persistence and maintaining access to sensitive data (such as emails or files) even after potential credential resets.
Detects non-interactive sign-in events in Entra ID that occur without a preceding interactive sign-in session on the same device that successfully satisfied a multi-factor authentication (MFA) challenge. This behavior is indicative of token replay attacks or session hijacking where an adversary attempts to use harvested session cookies or tokens to access resources.
Detects anomalous Entra ID sign-in patterns indicating potential session hijacking or stolen session cookie replay. The rule identifies pairs of successful sign-ins where the geographic distance and time elapsed suggest impossible travel, or where the device/browser context changes without a fresh MFA challenge, suggesting the bypass of authentication requirements via persistent session tokens.
Detects unauthorized access to common browser credential storage files (Login Data, Cookies, Web Data, Local State) by processes other than standard web browsers. This rule identifies potentially malicious activity by filtering for rare or unsigned binaries executing from common staging directories (Temp, Downloads) or accessing browser files shortly after the process launch, which is a common behavior pattern for info-stealer malware.
Detects successful authentication attempts using legacy protocols or non-interactive refresh tokens for user accounts previously flagged within a 14-day window as being involved in infostealer or credential exposure events.
Detects attempts to enumerate or access Windows Credential Manager and vault files, often used by adversaries to extract cached credentials. The rule monitors for execution of vaultcmd.exe, invocation of keymgr.dll via rundll32.exe, and unauthorized access to credential storage paths in AppData by non-system processes.
This rule detects potential session hijacking by monitoring for the reuse of session or refresh tokens from unrecognized devices, browsers, or user agents, particularly when such activity occurs without an interactive MFA challenge. This behavior is indicative of an attacker attempting to use stolen session cookies or tokens to access cloud resources.
Detects processes that access multiple categories of sensitive data (browser autofill, cryptocurrency wallets, password manager exports, or system fingerprinting files) within a short time window. This behavior is highly indicative of modular infostealers or data-collection malware conducting 'stacking access' to stage sensitive information for exfiltration.
Page 170 of 1168