Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,542 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where wscript.exe deletes a .zip archive from within the C:\Users\Public\ directory structure. This activity is frequently associated with VBScript droppers performing anti-forensic cleanup by removing staged payloads after extraction but prior to execution.
This rule detects the execution of script files (such as .vbs, .vbe, .js, .jse) via wscript.exe when the file name uses a double-extension technique (e.g., .pdf.vbs) to masquerade as a benign PDF document. These files are typically found in temporary or user-download directories, indicating potential malicious activity initiated by downloaded attachments.
Detects potential malicious VBScript behavior where the script queries system language settings via WMI and subsequently launches a decoy message box commonly associated with initial-stage malware loaders or droppers to deceive users before initiating a payload download.
This rule identifies sign-in events using an External Authentication Method (EAM) that occur within the 2-day cache window immediately following a certificate or key credential update for an application or service principal in Entra ID. This detection highlights a timeframe where an attacker potentially possessing a compromised old signing key could use it to forge tokens before the Entra cache refreshes.
Detects network activity associated with the ORAX control-plane panel and management service. The rule identifies HTTP traffic containing OraxManage or OraxRDP service strings, SignalR negotiate handshakes directed to common ORAX management ports, and connections to identified ORAX C2 infrastructure domains and IP addresses.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by identifying a pattern where a successful multi-factor authentication sign-in event is quickly followed by another successful sign-in for the same user from a different IP address, device, or geographic location. This behavior is indicative of session cookie theft and replay, commonly associated with phishing toolkits like Evilginx or NovaCookies.
This rule detects a multi-stage phishing campaign where an attacker uses legitimate Notion infrastructure to host PDF invitation lures. The detection correlates email delivery of a Notion-themed invitation with a subsequent user click on a URL containing device code authorization keywords (such as 'device', 'devicelogin', or 'code') within a 60-minute window, which is indicative of a device-code harvesting attack.
Detects potential Adversary-in-the-Middle (AiTM) session token replay attacks where a user successfully authenticates with MFA and is followed shortly by a subsequent successful login for the same user from a different IP address or device without a fresh MFA challenge, suggesting the use of a stolen session cookie.
This rule detects potential account hijacking via OAuth device-code authorization flow, specifically identifying patterns associated with phishing kits (e.g., EvilTokens, ARToken). It monitors sign-in events where the device code flow is utilized, specifically flagging successful grants that potentially bypass standard interactive credential prompts.
This rule detects inbound email messages containing HTML or related file types (htm, mhtml, shtml) that passed all standard authentication checks (SPF, DKIM, DMARC). This combination is often indicative of malicious phishing campaigns (such as those using LinXcoded or Mirage2FA techniques) sent from compromised, yet properly authenticated, Microsoft 365 or similar cloud-hosted email accounts, which bypass traditional sender reputation filters.
Page 321 of 1168