Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,119 copies47 likes38,561 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous activity in Microsoft Graph API logs where a single user or application interacts with three or more distinct category endpoints (e.g., users, groups, mailfolders) and at least six unique paths within a 30-minute interval, suggesting reconnaissance or broad enumeration of the M365 tenant environment.
Detects multiple consecutive MFA challenge events (ResultCode 50074 or 50140) for a single user session occurring on unmanaged devices (trustType is null or unknown) while using the Chrome browser. This pattern may indicate an attempt to bypass or exhaust MFA mechanisms, or credential abuse on non-compliant devices.
Detects high-volume, potentially automated data access, collection, or staging activities within Microsoft 365 services (SharePoint, OneDrive, and Exchange). The rule flags user identities performing a high count of operations (downloads, accesses, deletions, or export requests) across a wide range of unique objects or sites within a one-hour window, which is indicative of post-compromise mass data collection or exfiltration preparation.
Detects network activity associated with the 'SilverFox' malware family's command-and-control relay dispatcher. The rules identify specific HTTP requests to 'api.php', responses containing 'download_link', and the serving of legitimate WeChat installer payloads as a fallback mechanism for evasion, including the use of cache-busting parameters.
This rule is a placeholder intended to detect abuse of the OAuth device code authentication flow. The current logic attempts to identify successful logins associated with authentication failure reasons; however, the rule author notes that the necessary data source (Azure AD/Entra ID logs) is missing from the SentinelOne SDL event lake, making this detection non-functional for its stated purpose.
Detects instances where a new executable file (.exe) is written to the file system following a download event. The rule specifically looks for scenarios where the download URL ends in .exe or is a direct download link, while flagging cases where the referrer is empty or missing, often indicative of direct downloads from C2 infrastructure or scripts rather than user-initiated browser navigation.
Detects incoming or urgent security-themed emails (related to MFA, SSO, or passkeys) that originate from purported IT departments and are followed by a user clicking a link associated with Microsoft or authentication portals. This behavior is indicative of credential harvesting or consent phishing campaigns masquerading as internal IT security updates.
This rule detects suspicious outbound HTTP GET requests to a known domain (noah-ssh.com.cn) targeted by the SilverFox malware relay dispatcher. It specifically monitors for requests to '/api.php' containing a 13-digit numeric timestamp parameter, which is a characteristic pattern of its C2 communication.
Detects outbound network communication attempts by the SilverFox malware to known Cloudflare Workers relay infrastructure, specifically targeting hostnames associated with 'noah-relay' instances. The rule monitors DNS lookups, TLS SNI headers, and HTTP Host headers to identify potential Command and Control (C2) traffic.
This rule detects successful authentication to Azure/M365 identity and security management portals (My Sign-Ins, My Apps, My Profile) shortly after a risky or suspicious sign-in event for the same user. This pattern often indicates an account takeover scenario where an adversary, having potentially compromised credentials, immediately accesses account settings to perform further malicious actions, such as registering MFA devices or updating security proofs.
Page 457 of 1168