Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,539 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
Detects the registration of a new MFA device or authenticator by a user shortly after a password reset event, where the registration originates from an IP address classified as a hosting provider, datacenter, or VPN. This pattern is indicative of a help-desk or vishing-based account takeover attack where an adversary registers their own MFA device to gain persistent access.
Detects ZIP archives exceeding 100MB that contain specific DLL filenames often used for junk-padding to evade sandbox analysis. This technique is observed in brand-impersonation campaigns targeting users with fake security or authentication software lures.
Detects anomalous authentication behavior where the same session token or identifier is utilized by multiple distinct IP addresses or User-Agent strings within a short timeframe. This behavior is indicative of Adversary-in-the-Middle (AiTM) attacks, such as those employing Evilginx, where an attacker intercepts and replays stolen session cookies to bypass standard authentication and MFA controls.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Detects potential vishing or account takeover precursor activity where an external or guest Microsoft Teams user, impersonating IT or Help Desk support, communicates with a user who subsequently modifies their credentials or MFA configuration within the same 24-hour period.
Detects instances where an account assigned a help-desk or support role performs an MFA, password, or credential reset on an account tagged as an executive or VIP. This behavior is indicative of social engineering and help-desk impersonation attacks commonly utilized by threat actors to perform rogue MFA takeovers.
Detects the execution of known remote access or remote monitoring software (such as TeamViewer, AnyDesk, or ScreenConnect) on corporate-issued Windows endpoints. The rule triggers on process execution patterns associated with unauthorized remote control, specifically looking for indicators of unattended access or silent installation commonly used by overseas actors to remotely operate company-issued laptops assigned to fraudulently hired identities.
Detects the execution of known remote access or remote monitoring software (such as TeamViewer, AnyDesk, or ScreenConnect) on corporate-issued Windows endpoints. The rule triggers on process execution patterns associated with unauthorized remote control, specifically looking for indicators of unattended access or silent installation commonly used by overseas actors to remotely operate company-issued laptops assigned to fraudulently hired identities.
Page 302 of 1168