Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,556 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modifications to a user account's authentication methods, specifically when an increase in the number of configured multi-factor authentication (MFA) devices or methods occurs. This is often associated with an adversary enrolling their own device to bypass MFA or maintain persistent access.
Detects emails from specific suspicious domains or senders masquerading as executive roles (CEO, CFO) that contain attachments with 'invoice' in the filename and subject lines indicative of urgent financial transactions (e.g., payment, wire transfer). This pattern is commonly associated with Business Email Compromise (BEC) and malicious document delivery.
Detects the execution of Microsoft Teams client processes on endpoints associated with user accounts that have already been flagged as compromised via authentication anomalies. This rule acts as a pivot and investigation tool for tracking potentially malicious activity within Teams on impacted hosts.
Detects the use of the device code authentication protocol in Azure Sign-in logs, which is a common vector used in Adversary-in-the-Middle (AiTM) phishing attacks to hijack OAuth tokens.
Detects a suspicious scenario where a non-root process associated with Acronis backup plugins (typically used on cPanel, WHM, or Plesk servers) spawns a child process that executes with root privileges. This behavior is indicative of potential privilege escalation exploiting CVE-2026-87886.
Detects outbound proxy traffic indicating potential Adversary-in-the-Middle (AiTM) phishing activity. The rule identifies requests directed at domains mimicking major Identity Providers (Microsoft, Okta, Duo, Google) that either utilize punycode homograph encoding or arrive via known URL shortener/redirector services, while filtering out known legitimate brand domains.
Detects successful Azure AD sign-in events where the session is marked as compliant or trusted by Conditional Access policies, but simultaneously flagged by Identity Protection as originating from an anonymized IP (e.g., residential proxy, VPN). This indicates an adversary has bypassed location-based Conditional Access controls, likely in the context of an Adversary-in-the-Middle (AiTM) phishing attack.
This rule detects potentially malicious child processes spawned by processes associated with Microsoft Semantic Kernel agents. These agents may be exploited to execute administrative tools, living-off-the-land binaries (LOLBins), or networking utilities commonly used in post-exploitation activities, such as credential dumping, discovery, or command execution.
This rule monitors for high-frequency download or access events of files associated with AI development, such as model weights (.pt, .ckpt, .safetensors, .h5, .onnx, .pkl, .pb), checkpoints, and research datasets from cloud storage. It triggers when an account accesses or downloads 20 or more unique AI-related files within a 60-minute window, which is indicative of unauthorized data exfiltration of intellectual property.
Detects high-volume AI/LLM inference or GPU-compute provisioning activity from a single identity within a short duration. This behavior is indicative of LLMJacking, where compromised cloud credentials are used to spin up unauthorized, resource-intensive AI workloads for profit.
Page 431 of 1168