Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,431 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the initialization of cloud synchronization tools like rclone or MEGAsync, accompanied by the creation of configuration files and subsequent high-volume network activity directed toward common cloud storage providers, indicative of unauthorized data exfiltration.
Detects when highly privileged roles (e.g., Global Administrator) are assigned to users in Entra ID, specifically flagging instances where the actor assigns the role to themselves (self-elevation) or where the target account was created within the last 7 days. This behavior deviates from standard administrative workflows and is a strong indicator of potential account compromise or malicious privilege escalation.
This rule detects potential credential dumping from the Local Security Authority Subsystem Service (LSASS) memory. It identifies two common techniques: 1) The use of the Windows 'comsvcs.dll' library exported via 'rundll32.exe' to initiate a minidump of the LSASS process, and 2) Unauthorized processes opening handles to LSASS with specific access rights (0x1010, 0x1410) often associated with memory reading for dumping purposes.
Detects anomalous NTLM network logons (Logon Type 3) where the same user account authenticates to multiple distinct hosts within a short time window. This behavior is correlated with NTLM validation (4776) events to identify potential Pass-the-Hash activity used for lateral movement.
Detects potential password spraying activity by identifying high-volume failed authentication attempts (ResultType 50126 or 50053) against multiple accounts from a single source IP, followed by a successful authentication from the same IP. This pattern indicates an adversary who has identified one or more valid credentials after an initial spraying campaign.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin) or PowerShell cmdlets to delete Volume Shadow Copies or backup catalogs. This behavior is commonly associated with ransomware attempts to prevent system recovery.
This rule monitors for persistence mechanisms by detecting modifications to Windows Registry Run/RunOnce keys or the creation of files within the Windows Startup folder. It specifically flags instances where the executable or script being registered resides in high-risk directories such as Temp, AppData, or Downloads, and correlates these events with recent process execution to confirm the persistence activity.
Detects successful user sign-ins from geographically distant locations occurring within a timeframe that is physically impossible to traverse (implied speed > 900 km/h). The rule further filters for scenarios where the device used for authentication appears non-compliant or uses an unrecognized method, potentially indicating an attacker utilizing stolen credentials and bypassing MFA.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as mshta, certutil, regsvr32, rundll32, and msiexec, where the command-line arguments contain suspicious patterns indicative of script execution or remote file fetching. These behaviors are consistent with T1218 (System Binary Proxy Execution) to bypass security controls by utilizing trusted, signed binaries to execute malicious code.
Detects multiple Kerberos AS-REQ (Event ID 4768) requests initiated for distinct user accounts from a single source IP within a short timeframe (10 minutes) where Kerberos pre-authentication was not used (Pre-Authentication Type 0). This pattern is a key indicator of AS-REP roasting activity, often performed by tools like Rubeus or Impacket's GetNPUsers.py to harvest user TGTs for offline cracking.
Page 194 of 1168