Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects high-frequency, sustained queries to an ML inference endpoint from a single identity, indicative of gradient-free training data reconstruction or model inversion attacks. The rule triggers when a specific user or API key performs over 100 successful requests within a 15-minute window, where the responses include granular confidence, probability, or logit values, which are typical targets for reconstructing training data.
Detects potential model weight poisoning or unauthorized integrity compromise by identifying training jobs launched by non-authorized users, model file modifications in production paths that bypass CI/CD approval gates, or integrity mismatches between deployed model artifacts and their corresponding approved training outputs.
Detects anomalous high-frequency queries to machine learning model inference endpoints involving probability or confidence score outputs. This behavior is indicative of a membership inference attack, where an adversary attempts to determine if specific data samples were included in a model's training set by harvesting confidence scores.
Detects high-frequency, sustained queries to an ML inference endpoint from a single identity, indicative of gradient-free training data reconstruction or model inversion attacks. The rule triggers when a specific user or API key performs over 100 successful requests within a 15-minute window, where the responses include granular confidence, probability, or logit values, which are typical targets for reconstructing training data.
Detects potential model weight poisoning or unauthorized integrity compromise by identifying training jobs launched by non-authorized users, model file modifications in production paths that bypass CI/CD approval gates, or integrity mismatches between deployed model artifacts and their corresponding approved training outputs.
Detects instances where a user account modifies security information, registers a new MFA method, or resets a password shortly after a successful sign-in from a country not observed for that user within the previous 30 days. This pattern is indicative of potential account takeover where an adversary adds persistence or MFA bypass methods to a newly compromised account.
Detects MFA fatigue or push-bombing attacks where a user account experiences an abnormally high volume of MFA request denials in a short duration (10 minutes), followed by a successful authentication event. The rule specifically looks for evidence where the successful authentication potentially originates from a different IP address than the failed attempts.
Detects phishing emails containing suspicious URLs pointing to PaaS platforms (Azure Static Web Apps, Cloudflare, Firebase) that exhibit credential harvesting characteristics (branded keywords or base64 patterns). The rule correlates these emails with subsequent clicks and a successful M365 sign-in by the same user within 30 minutes of the click, indicating a probable successful credential compromise.
Detects Azure AD sign-in events using the device code authorization flow where only single-factor authentication was performed. This pattern is indicative of potential device code phishing attacks where users are tricked into entering codes on attacker-controlled pages to grant access tokens, bypassing standard MFA requirements.
Detects proxy requests to typosquatted domains masquerading as major job platforms (LinkedIn, Indeed) that are serving suspicious file extensions (.hta, .ps1) often associated with the 'ClickFix' social engineering technique. This rule monitors for URLs mimicking these brands while attempting to deliver potentially malicious scripts to the user.
Page 407 of 1168