Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,546 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a burst of multiple MFA push authentication denial events for a single user within a 10-minute window, indicative of an MFA fatigue (push-bombing) attack. This behavior is often followed by an attempt to wait for the user to inadvertently approve the notification.
Detects the execution of known NetSupport Manager remote access tool binaries from locations outside of the official installation directories. This behavior is indicative of unauthorized use or persistence of remote management software, often used as a RAT by adversaries.
Detects the removal of phishing-resistant authentication methods (FIDO2 or Windows Hello for Business) and the registration of weaker, phishable MFA methods (SMS, voice, or phone app) within Entra ID. This behavior is indicative of an attacker attempting to lower the security posture of an account to facilitate future credential theft or unauthorized access.
Detects instances where an administrative action involving a password reset or MFA configuration (StrongAuthenticationMethod update) is initiated by a user account that lacks the designated Helpdesk or Password Administrator role. This behavior indicates potential unauthorized privilege escalation or credential manipulation by an account not formally assigned to support workflows.
Detects instances where processes (excluding known legitimate .NET processes) load common .NET runtime modules (e.g., clr.dll, mscoree.dll) followed by remote process injection or handle-based process access, which is often indicative of reflective assembly loading used by loaders like PIVOTPIPE to execute malicious code within a target process.
This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.
Detects a suspicious sequence of events where a user modifies their MFA phone number, followed within 30 minutes by a sign-in event flagged with 'impossibleTravel' or 'unfamiliarFeatures' risk. This pattern is indicative of potential SIM-swap fraud, where an attacker has hijacked the user's phone number to receive MFA prompts and then attempts to access the account from an anomalous location.
Detects the creation or modification of Windows Registry Run/RunOnce keys or files within the Startup folder where the target command path is deemed suspicious (e.g., temp directories, ProgramData), utilizes known LOLBins, or contains common obfuscation flags (e.g., -enc, IEX, -w hidden) frequently associated with persistence mechanisms.
Detects the execution of mshta.exe with suspicious command-line arguments that indicate the loading of remote HTML Applications (HTA) via URLs or inline scripts (javascript/vbscript). This behavior is often indicative of fileless malware execution and living-off-the-land techniques to bypass security controls.
Detects anomalous DNS traffic patterns indicative of command-and-control (C2) or data exfiltration over the DNS protocol. The rule identifies suspicious queries containing long, high-entropy subdomain labels that suggest payload encoding, as well as the use of TXT records for unauthorized data transmission.
Page 354 of 1168