Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects successful modifications to user MFA methods (StrongAuthenticationMethod) where the associated device details are missing or indicate a software-only token activation. This behavior is often indicative of an adversary adding their own MFA device to a compromised account to maintain persistent access or bypass MFA requirements.
Detects compromised versions (2.35 and 2.36) of the 'Admin Menu Editor Pro' WordPress plugin that were distributed via the official update infrastructure. These versions include embedded web shell code, as indicated by the presence of both plugin identification strings and common PHP execution or command-line utility functions used in backdoors.
Detects the execution of Acronis backup-related processes by a non-root user while the process is running with root-level privileges (UID 0). This pattern indicates potential privilege escalation or abuse of existing backup utilities to run with elevated permissions in a context where they should not be.
Detects the execution of WScript or CScript from a command line containing 'Public' in close temporal proximity (5 minutes) to the creation of directories within 'C:\Users\Public\'. This pattern is often associated with malware staging, where scripts are executed from publicly accessible folders often used as staging grounds for malicious payloads.
Detects the presence of PHP web shell code within specific versions (2.35/2.36) of the Admin Menu Editor Pro plugin. This rule targets malicious files introduced via a supply chain compromise of the plugin's update distribution channel, specifically looking for common PHP obfuscation and execution functions associated with web shells.
Detects a sequence of events indicative of an Adversary-in-the-Middle (AiTM) attack, specifically 'NovaCookies'. The rule identifies a phishing email lure (DocuSign/SharePoint-themed) received by a user, followed within a 6-hour window by an anomalous Microsoft 365 sign-in from that same user. The anomalous sign-in is defined by either risk flags or conditional access failure, suggesting potential replay of a captured session cookie.
Detects anomalous, high-frequency password submission patterns from a single IP address within a short timeframe, which is indicative of an Adversary-in-the-Middle (AiTM) phishing proxy (e.g., NovaCookies) testing multiple credentials before proceeding to MFA.
Detects a suspicious web navigation pattern indicative of NovaCookies or similar AiTM (Adversary-in-the-Middle) phishing infrastructure. The rule correlates a legitimate website visit with an immediate subsequent request to a .vu domain, within a short time window (30 seconds), using the same process (e.g., browser process). This identifies the redirect chain from a legitimate host to a disposable phishing landing page commonly used for credential harvesting.
Detects a potential Adversary-in-the-Middle (AiTM) attack sequence by correlating OneDrive/SharePoint document sharing email lures with subsequent successful Microsoft 365 sign-ins from unusual locations or user agents within a short time window. This activity often indicates session cookie theft and MFA bypass.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Page 483 of 1168