Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,430 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a trojanized Electron application performing anti-sandbox environment checks by querying GPU hardware information via WMI or PowerShell CIM cmdlets. This activity is characterized by the presence of the PYTHONUTF8 environment variable and is identified as a precursor step to attempting Microsoft Defender exclusions and launching a malicious payload.
Flags conditional access policy edits (MFA exclusions, trusted-location additions) occurring shortly after a support-desk-driven identity reset on the same tenant/admin account — the step attackers use to lock in access after a vishing-driven MFA bypass.
Flags MFA method deletions performed by an actor other than the account owner, especially when followed by registration of a new authenticator — the signature of a helpdesk agent socially engineered into swapping a victim's MFA factor.
Flags Temporary Access Pass issuance to accounts holding privileged directory roles, especially when issued by Tier-1 support rather than a PIM-approved workflow — TAP is the modern equivalent of the helpdesk MFA bypass abused in Scattered Spider-style intrusions.
Detects the reuse of a session or refresh token from a geographic location that contradicts recent user activity (impossible travel) without a new interactive MFA challenge. This activity is indicative of Adversary-in-the-Middle (AiTM) phishing attacks, such as those leveraging Evilginx, where session cookies are captured and replayed from attacker infrastructure to bypass multi-factor authentication.
Detects when a user adds a new Multi-Factor Authentication (MFA) method such as a phone number, authenticator app, or FIDO2 key in Entra ID (Azure AD). Attackers often register their own MFA devices to maintain persistent access to a compromised account, particularly following a successful password reset or social engineering event.
Detects the execution of known Remote Monitoring & Management (RMM) software on Windows systems. This behavior is frequently abused by threat actors, including Scattered Spider, to maintain persistent access after gaining control via social engineering or identity-based attacks (e.g., vishing-driven credential or MFA resets).
Detects a suspicious pattern where an inbound Microsoft Teams call or chat from an untrusted external guest tenant is followed within 30 minutes by a credential, MFA, or account-recovery action on the target user's account in Entra ID. This behavior is indicative of a vishing-over-Teams attack where an adversary impersonates IT support to facilitate unauthorized account recovery or MFA bypass.
Detects a suspicious sequence of identity-related operations performed by a single user within a 2-hour window. The chain consists of a password reset, MFA method modification, new device registration, and a subsequent privilege escalation event (such as role assignment or application consent). This pattern is consistent with helpdesk-vishing campaigns often used by threat actors like Scattered Spider to perform full account takeovers.
Detects scenarios where common download utilities are used to fetch a file from the internet, followed by the immediate execution or loading of that same file within a 10-minute window, indicative of an Ingress Tool Transfer followed by execution.
Page 190 of 1168