Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,519 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modifications or additions to Conditional Access policies or External Authentication Methods in Azure AD/Entra ID. These changes could be indicative of an adversary attempting to bypass multi-factor authentication or establish persistence by weakening authentication controls.
Detects an attempt to bypass SharePoint authentication using a 'Register' directive in a POST request body directed at an .aspx page that is not a recognized ToolPane page. This pattern is indicative of an exploit attempt against a public-facing SharePoint server, specifically targeting vulnerability CVE-2026-65660.
Detects the presence of ZIP archive files masquerading as 'Evernote.zip' that contain 'notepad++.exe', which is a pattern frequently observed in VBScript-based downloaders utilizing binary sideloading to execute malicious payloads.
Detects the use of WScript or CScript to query the Win32_OperatingSystem WMI class for the InstallDate property. This behavior is commonly used by malware to identify the system installation time, which can serve as a simple heuristic for sandbox evasion or environmental keying.
Detects anomalous, mass-access behavior targeting plaintext credential files, certificate stores, private keys, or password-manager databases located on general-purpose network shares. Such activity is often indicative of an adversary conducting discovery or collection of credentials for lateral movement and privilege escalation.
Detects anomalous, mass-access behavior targeting plaintext credential files, certificate stores, private keys, or password-manager databases located on general-purpose network shares. Such activity is often indicative of an adversary conducting discovery or collection of credentials for lateral movement and privilege escalation.
Detects the granting of tenant-wide admin consent for 'openid' and 'profile' scopes to 'AllPrincipals' within an Azure environment. This activity is indicative of the final stage in a TrustSink or similar rogue External Authentication Method (EAM) attack, where an adversary configures an application to bypass user consent prompts for sensitive identity scopes.
This rule correlates email attachment delivery events with subsequent process creation events on the recipient's endpoint. It identifies scenarios where a known document reader or mail client (Outlook, Word, Excel, PowerPoint, Adobe Acrobat/Reader) spawns a suspicious child process (PowerShell, CMD, WScript, CScript, MSHTA, Rundll32, or Regsvr32) shortly after a file is delivered via email to the same user. This detects the immediate execution phase of a phishing attack.
Detects successful sign-in events where Multi-Factor Authentication (MFA) was satisfied using an 'External Authentication Method' that reports specific claim identifiers ('possessionorinherence' or 'hwk'). This pattern is indicative of the TrustSink rogue-EAM (External Authentication Method) technique, where an attacker exploits custom MFA providers to forge MFA success assertions, effectively bypassing legitimate hardware-key requirements.
Detects the deletion of .zip files within the Public directory by VBScript or JScript interpreters (wscript.exe or cscript.exe). This pattern is often indicative of a malicious dropper or downloader that extracts a payload from a staged archive and subsequently removes the evidence to hinder analysis and forensics.
Page 253 of 1168