Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,546 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Flags privileged or helpdesk-support account access to the identity admin console from a never-before-seen device fingerprint within minutes of a password reset on any downstream user account.
Flags re-enablement of legacy/basic authentication protocols or a new per-user authentication-policy exclusion occurring shortly after that account's MFA method was reset — the fallback technique used to sidestep modern MFA once the vishing playbook's reset step succeeds.
Detects attempts to bypass macOS Gatekeeper security controls by manually removing the 'com.apple.quarantine' extended attribute using 'xattr' or by modifying executable permissions with 'chmod' on specific system or sensitive file paths, such as 'iSync'. These actions are commonly performed to evade execution restrictions on downloaded or untrusted files.
Detects modifications to Entra ID (Azure AD) Conditional Access policies where a user or group is explicitly added to an exclusion list. This behavior can be used by adversaries to bypass mandatory Multi-Factor Authentication (MFA) or device compliance requirements, facilitating persistence on a compromised account.
Detects an Azure AD/Entra ID device registration or join event occurring within 60 minutes of an account-recovery action (password reset, MFA reset, or account unlock) for the same user identity. This sequence is indicative of an attacker registering a managed device to maintain persistent, long-term access following a successful account takeover or vishing-based helpdesk credential reset.
Detects a potential OAuth device code phishing abuse pattern where an authenticated device code sign-in is immediately followed by a new device registration or Primary Refresh Token (PRT) issuance for the same user, potentially originating from a different device or IP address.
Detects the execution of rundll32.exe where the command line points to a DLL file located on a remote WebDAV share (using the 'davwwwroot' path syntax). This technique is often used to execute malicious payloads while bypassing local disk protections.
Detects the creation of mailbox inbox rules (New-InboxRule) or modification of mailbox forwarding configurations (Set-Mailbox) that auto-forward, auto-delete, or move messages to hidden or secondary folders (e.g., RSS, Deleted Items). This behavior is characteristic of Business Email Compromise (BEC) follow-on activity intended to maintain covert access to victim communications, particularly following account takeover events like password resets.
Detects the use of anomalous session tokens in Azure Active Directory (Azure AD) sign-in events where the token is being used in a non-interactive manner without a corresponding interactive authentication event. This behavior is indicative of token theft or infostealer activity, where an adversary replays a stolen session cookie from a new, untrusted, or non-compliant device to bypass authentication protections.
Detects the installation of a new kernel-mode service using system utilities like sc.exe, cmd.exe, or powershell.exe, which is a common indicator of a Bring Your Own Vulnerable Driver (BYOVD) attack intended to gain kernel-level privileges.
Page 353 of 1168