Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,117 copies47 likes38,561 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous, high-frequency cloud management API requests across multiple sensitive paths (such as directory roles, applications, and service principals) from a single account. This pattern is indicative of automated enumeration or discovery of cloud infrastructure, permissions, and identity configurations, which is often a precursor to further exploitation.
Detects anomalous activity in Microsoft Graph API logs where a single identity (user or application) performs a high volume of requests across multiple sensitive administrative categories, such as directory role management, authentication method modification, application or service principal changes, and OAuth consent operations. This pattern is indicative of potential unauthorized reconnaissance, privilege escalation, or persistence attempts within an Azure/Microsoft 365 environment.
This rule detects potentially malicious messages sent via Microsoft Teams that contain keywords related to passkey enrollment or SSO updates, which are common social engineering tactics used in phishing campaigns to trick users into compromising their account credentials or security settings.
Detects obfuscated PHP code within the Admin Menu Editor Pro plugin, specifically targeting indicators associated with the supply chain compromise of versions 2.35 and 2.36. The rule searches for common PHP execution functions used in web shells within the context of the vulnerable plugin directory.
Detects anomalous, high-volume file download activity from SharePoint or OneDrive initiated through identified anonymous proxy services. This behavior suggests potential data exfiltration by an adversary attempting to mask their source IP address while offloading large amounts of data.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains associated with credential harvesting campaigns (specifically those attributed to Storm-3121/Storm-3032). These domains are used to lure users into providing credentials under the guise of SSO or passkey setup.
This rule detects the presence of specific SilverFox malware payload files by matching their SHA256 hashes against known indicators of compromise. This identification is typically used for file integrity monitoring, endpoint scanning, or gateway-based file filtering to prevent malicious code execution.
Detects communication between a host and a suspected malicious domain (noah-ssh.com.cn) characterized by a specific API request containing a millisecond timestamp and a subsequent HTTP response containing a 'download_link' field. This pattern is indicative of the SilverFox malware relay mechanism, likely used for staging and downloading additional malicious payloads.
Detects the presence of specific versions (2.35 and 2.36) of the Admin Menu Editor Pro WordPress plugin, which were reported to be distributed as trojanized versions via a compromised update infrastructure.
Detects the use of the OAuth device code authentication flow in Azure AD/Entra ID sign-in events. This flow is frequently abused by attackers who use vishing or SMS phishing pretexts to trick users into authorizing a device login, enabling the attacker to obtain a valid session token without direct credential harvesting or cookie theft.
Page 458 of 1168