Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,306 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the addition of a new federated domain or a modification to an existing domain's authentication settings to Federated, where the domain was not previously verified within a standard verification window. This technique is often used by adversaries to establish persistence and perform self-issued token forgery (e.g., SAML/JWT) by trusting an attacker-controlled identity provider.
Detects when a user is added as an owner to an Azure AD Application or Service Principal, specifically highlighting instances where the new owner does not currently hold a privileged directory role. This pattern is often used as a persistence mechanism to maintain long-term access to an environment without requiring high-level administrative credentials.
Detects the addition of suspicious, attacker-controlled URLs (such as webhook.site, ngrok.io, or pipedream.net) as valid redirect URIs in an OAuth application's configuration. This technique can be used by an adversary to intercept OAuth authorization codes or tokens by luring users through a malicious authorization link, enabling persistent unauthorized access without further consent.
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
Detects potential lateral movement by users who have recently been flagged for credential theft or infostealer activity. The rule correlates initial security alerts with subsequent Windows logon events (RDP, network/WinRM) or SMB share access, identifying users connecting to multiple distinct destinations within a 48-hour window.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects potential abuse of Azure Cloud Shell backing storage (acsCloudShell) to stage or persist malicious scripts following an Azure AD session compromise. Adversaries may use this storage to blend in with legitimate engineering operations while maintaining persistent access to their tooling.
Detects administrative actions in Azure that disable or modify diagnostic settings, which stops the flow of logs to services like Azure Sentinel/Log Analytics, or deletes policy assignments. Such actions are often performed by adversaries to blind security operations monitoring prior to lateral movement or further malicious activity.
This rule detects administrative actions in GCP that involve modifying or deleting Cloud Logging sinks, or disabling specific services, with a specific focus on disabling the logging service itself. Adversaries may perform these actions to tamper with audit trails and evade detection of malicious activities.
Page 43 of 1168