Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,524 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Flags changes to a user's registered SMS/voice MFA phone number followed by a successful high-risk sign-in — the SIM-swap/SMS-interception bypass step documented across the 2024-2026 vishing threat-report taxonomy (CrowdStrike, Mandiant, Pindrop).
Detects device registration events in Entra ID where the device display name does not conform to standard enterprise organizational naming conventions. Adversaries may register unauthorized devices to an Entra ID tenant to bypass conditional access policies or gain persistence.
Detects successful self-service password reset (SSPR) activities within Azure Active Directory. This event signifies that a user has successfully changed or reset their password using the self-service mechanism.
Detects a potential OAuth device code phishing abuse pattern where an authenticated device code sign-in is immediately followed by a new device registration or Primary Refresh Token (PRT) issuance for the same user, potentially originating from a different device or IP address.
Detects an MFA authentication method reset or password reset performed against an Entra ID / Azure AD user account, initiated by an account holding a helpdesk/support administrative role (Helpdesk Administrator, Password Administrator, Authentication Administrator, User Administrator). This is stage one of the Scattered Spider / Octo Tempest help-desk-impersonation chain implicated in more than 100 intrusions per the 2025 CISA/FBI joint advisory: an attacker socially engineers a support agent into resetting a target's MFA method or password, then immediately registers a new device or authenticator to complete account takeover.
Analyst follow-up: pivot on UserId/TargetUserPrincipalName to check for a device-add/Entra-join event ('Add device', 'Register device', 'Join device to Azure AD', 'Update device') within 30 minutes of this alert for the SAME identity — that sequence confirms a completed takeover and should be escalated to critical.
Analyst follow-up: pivot on UserId/TargetUserPrincipalName to check for a device-add/Entra-join event ('Add device', 'Register device', 'Join device to Azure AD', 'Update device') within 30 minutes of this alert for the SAME identity — that sequence confirms a completed takeover and should be escalated to critical.
Detects the assignment of high-privileged Entra ID roles to a user account shortly after that same account underwent a password reset or MFA method change initiated by a helpdesk-privileged account. This detection pattern is specifically designed to identify Scattered Spider (UNC3944) tactics where social engineering is used to manipulate helpdesk processes to compromise identities and escalate privileges.
This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.
This rule detects network communication to known malicious IP addresses or sessions utilizing TLS certificates that impersonate the Uzbekistan railway authority (azure.uzrailwaystax). This behavior is characteristic of the SpiceRAT/NodeEdgeRAT malware families, which use these specific certificates to establish Command and Control (C2) channels.
Detects network traffic involving TLS certificates or Server Name Indication (SNI) values that attempt to impersonate the Uzbekistan state railway authority (azure.uzrailwaystax.com). The rules also flag connections associated with certificates issued by 'TLC DV TLS CA' and known C2 infrastructure using the spoofed railway certificate.
Detects network traffic involving TLS certificates or Server Name Indication (SNI) values that attempt to impersonate the Uzbekistan state railway authority (azure.uzrailwaystax.com). The rules also flag connections associated with certificates issued by 'TLC DV TLS CA' and known C2 infrastructure using the spoofed railway certificate.
Page 270 of 1168