Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,299 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized changes to the token-signing certificate for federated domains in Microsoft Entra ID (formerly Azure AD). This behavior is often associated with the Golden SAML attack technique, where an adversary modifies federation settings to forge authentication tokens. The rule filters for events occurring outside of standard business hours and alerts when the modification is not performed by known automation service accounts.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Detects the creation or modification of Granular Delegated Administrative Privileges (GDAP) relationships, or the assignment of highly privileged (Tier 0) roles, when performed by an application identified as a partner provider or via delegated administration. This rule monitors for potential abuse of trusted partner relationships to escalate privileges or establish persistence within a tenant.
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects the creation of high-cost, resource-intensive compute instances (such as GPU-enabled or large-scale VMs) within cloud regions that have not been previously utilized by the account, subscription, or project. This behavior is often indicative of unauthorized resource hijacking, such as crypto-mining or large-scale data processing by threat actors.
Detects the creation or modification of serverless functions (AWS Lambda, Azure Function Apps, GCP Cloud Functions) that exhibit high-risk configurations. These include functions assigned overly permissive IAM roles, configured for public or unauthenticated invocation, or tied to event triggers commonly abused for persistence in cloud environments.
This rule detects the creation or modification of identity federation trust configurations across multiple cloud platforms (AWS, Azure AD, GCP). Attackers often modify trust relationships to establish persistence, forge credentials, or escalate privileges by introducing malicious identity providers (SAML/OIDC) that grant unauthorized access to the environment.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
This rule identifies potential account compromise through the detection of non-interactive Azure AD sign-ins originating from geographically distant locations within a short, travel-implausible timeframe. Such activity is highly indicative of the theft and export of a Primary Refresh Token (PRT) from a legitimate endpoint, which is subsequently replayed by an adversary from external infrastructure to gain unauthorized access to cloud resources.
Detects the initialization of an AWS CloudShell environment or session. Attackers often abuse CloudShell as a managed, agentless environment within the provider's infrastructure to stage tools, perform reconnaissance using the AWS CLI, and exfiltrate data while bypassing standard endpoint-based detection.
Page 41 of 1168