Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,549 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a Bash stager script associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The script performs system architecture verification to download a specific Mach-O payload, makes the downloaded file executable using chmod, and subsequently executes the payload.
Detects DNS queries and TLS SNI traffic directed towards known domain names associated with the Sauron Loader command-and-control infrastructure. This rule identifies outbound communication attempts using hardcoded beaconing domains.
Detects known malicious SilverFox trojan payloads by matching their SHA256 file hashes. This rule operates on file hashing metadata to identify specific binary artifacts associated with the SilverFox threat actor, regardless of the delivery mechanism or download source.
Detects repeated MFA authentication failures for specific Microsoft applications (like OfficeHome, My Apps, My Sign-Ins) from the same user and source IP, typically indicative of an MFA fatigue (prompt bombing) attack. The rule identifies multiple authentication failures or interruptions (ErrorCode 50074 or 50140) from unmanaged or unregistered devices, which suggests an adversary attempting to force a user to approve an MFA request.
This rule monitors authentication activity within Microsoft Entra ID (formerly Azure AD) involving the Device Code flow. This flow is often abused by attackers through phishing to obtain access tokens. The rule detects and lists occurrences of authentication attempts leveraging the device code grant, facilitating the investigation of potentially malicious token acquisition or replay attacks.
Detects high-volume API requests to Exchange REST services using a specific application ID or Outlook Web branding, where the account object ID is missing. This pattern is indicative of potential OAuth token abuse, where an attacker utilizes a stolen token to perform automated actions without the presence of a legitimate user session.
Detects endpoint DNS resolution for the 'mysignins.microsoft.com' domain. This domain is frequently used in Adversary-in-the-Middle (AiTM) phishing attacks to facilitate user interaction with legitimate Microsoft portals while the attacker intercepts session tokens.
This rule detects known command-and-control (C2) domains associated with the Sauron Loader malware family, specifically by inspecting TLS Server Name Indication (SNI) fields. It also monitors for patterns of repeated connections to domains prefixed with 'api.' over established TLS sessions, which may indicate beaconing behavior characteristic of C2 activity.
Detects network activity associated with the AMOS (Atomic Stealer) malware, specifically identifying C2 registration, heartbeats, or credential exfiltration attempts over the non-standard port 8133 using HTTP patterns matching its known API endpoints.
Detects the download and presence of the Atomic macOS Stealer (AMOS) payload, a 64-bit Mach-O executable, identified by specific file hashes or internal file structure characteristics (Mach-O magic bytes) within a specific file size range.
Page 375 of 1168