Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where a process named firefox.exe attempts to modify or create a registry run key, which is a common persistence technique, but the process file path does not correspond to the legitimate Mozilla Firefox installation directory. This behavior often indicates that an attacker is masquerading as a legitimate browser process to establish persistence.
This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.
Detects unauthorized write, create, or rename operations on the Windows HOSTS file (\drivers\etc\hosts). The rule excludes common system processes and paths associated with legitimate administrative or update activities, targeting potentially malicious attempts to redirect network traffic by modifying DNS resolution locally.
Detects successful Microsoft Intune enrollment events initiated using the Device Code authentication protocol in Azure AD/Entra ID. This flow is often abused by adversaries to perform OAuth device code phishing, allowing them to gain unauthorized access to cloud resources by tricking users into authorizing a malicious application on their own devices.
Detects the creation of email mailbox or transport rules that perform actions like hiding, deleting, marking as read, forwarding, or redirecting emails with finance or payment-related keywords. This behavior is indicative of a Business Email Compromise (BEC) post-exploitation workflow where adversaries attempt to conceal malicious activity or divert financial communications.
Detects the creation of a PowerShell process that identifies itself as being spawned by explorer.exe, while the process ID (PID) and parent process ID (PPID) relationship indicates inconsistency, often characteristic of the PSSpoof technique used by malware like SloppyRAT to evade detection by spoofing the process tree.
This rule monitors authentication events for the 'deviceCode' protocol where multi-factor authentication (MFA) was not required or completed. This is a common indicator of device code phishing attacks, where an adversary lures a user into authorizing a malicious device or application, often bypassing organizational MFA policies.
Detects the creation of a file on the system that matches a known malicious SHA256 hash.
Detects the execution of processes containing indicators associated with Alinubx or the string 222024, which are potentially linked to malicious software or unauthorized tools.
Detects the use of PowerShell to reflectively load .NET assemblies into memory, often associated with fileless malware execution. The rule monitors for common reflection-based methods (e.g., Assembly.Load, [System.Reflection.Assembly]) in conjunction with encoded command patterns or script execution.
Page 410 of 1168