Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,546 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to bypass or tamper with the Antimalware Scan Interface (AMSI). This rule monitors for command-line arguments indicative of reflection-based patching of AmsiUtils and forced AmsiScanBuffer failures, as well as registry modifications to AMSI providers.
Detects successful user authentications originating from geographically distant locations within a time window that makes physical travel impossible. The detection further filters for scenarios where the subsequent sign-in is associated with a different, non-compliant, or untrusted device, indicating a likely compromised account.
Detects anomalous Kerberos ticket requests characteristic of Golden Ticket attacks. These forged tickets are created offline using the KRBTGT account hash, bypassing legitimate KDC TGT issuance, and frequently exhibit default Mimikatz artifacts such as RC4 encryption or extended ticket lifetimes.
Detects anomalous mass consent grants to OAuth applications by users within the environment. This rule monitors for high-risk permissions such as Mail.Read and Files.ReadWrite.All, which are commonly used in consent phishing and application-based persistence campaigns to gain unauthorized access to mailbox and file resources.
This rule detects potential MFA fatigue attacks (Push Bombing) by monitoring sign-in logs for a high volume of authentication prompts directed at a single user within a one-hour window. It specifically identifies patterns where a user receives multiple denied MFA push requests followed by at least one successful approval. The rule also accounts for suspicious behavior such as requests originating from multiple IP addresses or geographic locations.
This rule identifies potential DNS tunneling activity (often used for C2 or data exfiltration) by analyzing DNS queries for anomalous patterns. It looks for high-entropy or excessively long subdomain labels, frequent use of suspicious record types like TXT or NULL, and high query volume to a single parent domain with low diversity in resolved IP addresses.
This rule detects the creation or modification of Exchange mailbox rules (Forward, Redirect, Delete, or Mark as Read) involving sensitive keywords (invoice, wire, payment, finance, remittance) shortly after an anomalous sign-in event or a password reset on the same account. This combination is a strong indicator of account takeover and mailbox persistence.
Detects active attempts to disable or interfere with security products, including EDR agents and antivirus software. The rule monitors for the use of 'sc.exe' to stop or reconfigure services, 'taskkill' to terminate security-related processes, and PowerShell commands utilizing 'Set-MpPreference' to modify Windows Defender real-time protection settings. These actions are frequently observed as a precursor to ransomware deployment or other malicious activities designed to evade detection.
Detects potential lateral movement by monitoring user accounts performing interactive RDP logons (LogonType 10) to multiple distinct internal hosts within a 15-minute window. Additionally, identifies RDP logons occurring outside of standard business hours (before 6 AM or after 8 PM), a pattern often associated with human-operated ransomware activity.
Detects instances where a user grants OAuth application permissions for high-risk scopes (e.g., mail access, offline access). The rule flags these grants, with higher risk scores assigned if the application publisher is unverified or unknown, helping identify potential illicit consent grant attacks often used to maintain long-term persistence in cloud environments.
Page 356 of 1168