Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects authentication failures in Microsoft Entra ID associated with external MFA providers. This condition, specifically indicated by failure codes 70002 or 50012 and associated error messages regarding signature validation or external token trust, may indicate an attempt to bypass authentication via a rogue MFA provider or a misconfigured integration.
Detects signs of the TrustSink technique where an Entra sign-in process, while at the MFA stage, is intercepted by redirecting the user to a rogue External Authentication Method (EAM) provider. This unauthorized provider typically uses look-alike domains or tunneling services to host phishing pages that harvest plaintext credentials and return forged MFA tokens to Entra.
Detects high-frequency, diverse Microsoft Graph API requests initiated by an identity, indicative of automated reconnaissance or enumeration of the cloud environment. The rule tracks requests across multiple categories such as organization settings, user/group identities, privilege information, application configurations, and resource access within a 30-minute window.
Detects high-volume cloud storage access or download activity originating from the python-httpx library within a short window (2 hours). This behavior is often indicative of automated data scraping, exfiltration, or bulk content synchronization.
This rule monitors email, SMS, and voice logs for potential phishing attempts targeting user credentials. It specifically looks for social engineering lures related to passkey, SSO, or MFA updates that express urgency or imply service expiration, often masquerading as IT support communications.
Detects anomalous access patterns to Microsoft 365 SaaS applications where a single user session interacts with three or more specific portal applications (such as 'OfficeHome', 'My Apps', 'My Profile') within a five-minute window. This behavior may indicate an adversary attempting to map the environment or interact with multiple integrated services shortly after gaining access.
Detects host-enumeration activities performed by PowerShell processes, including anti-virus queries, system information gathering, network configuration checks, and file/drive enumeration, specifically when correlated with suspicious outbound network connections to common task-runner C2 infrastructure.
Detects Microsoft Entra ID sign-in events where the multi-factor authentication (MFA) requirement was marked as satisfied by an External Authentication Method (EAM) provider, but the authentication claims (AMR) include values typically reserved for locally verified hardware-based factors (e.g., hwk, fido). This pattern is indicative of a TrustSink attack, where a malicious OIDC identity provider injects forged assertions to bypass actual MFA requirements.
Page 481 of 1168