Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,564 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects anomalous backend activity associated with phishing kits, specifically monitoring for the dispatch of SMS or WhatsApp messages containing lure links. It identifies logs indicative of automated message dispatch (via send_sms_apix.log or WhatsApp Business API calls), filters for successful delivery indicators while excluding known error states, and verifies the presence of specific message components like recipient details and malicious templates.
Detects the AnonyMousKIT activity sequence, identified by the dispatch of a templated device-recovery lure via the WhatsApp Business API followed by a Telegram Bot API webhook alert to the operator within a 10-minute window. This temporal relationship between the outbound lure and the operator-side notification is used as a signature for the C2 orchestration.
Detects network activity characteristic of JWR or Outsider-style live phishing kits. The rule monitors for specific instruction tokens (e.g., card entry, verification codes, success indicators) in network requests within a short time window, indicating an operator-driven phishing session.
Detects authentication events associated with known actor infrastructure (AnonyMousKIT/Cluster B/UKT) and identifies anomalous crossover patterns where a single source IP authenticates into multiple distinct accounts within a short time window. This behavior is indicative of a shared backend infrastructure across multiple accounts or storefronts.
Detects a specific device-intelligence workflow pattern where an operator performs device reconnaissance (e.g., serial number checks, device model lookups) followed shortly by the generation of a malicious lure or tracking link (e.g., Five-channel lure), indicative of an attempt to gain unauthorized access to a victim device or account.
Detects HTTP traffic proxying Microsoft authentication paths (OAuth 2.0 authorization or CDN assets) via non-Microsoft domains. This behavior is indicative of an Adversary-in-the-Middle (AiTM) phishing attack using typosquatted infrastructure to intercept user sessions.
This rule detects network traffic indicative of an Adversary-in-the-Middle (AiTM) phishing attack targeting Microsoft 365. The rule identifies HTTP response bodies containing 'login.microsoftonline.com' and 'Enter Password' being served from a web server identified as 'openresty'. This configuration is common for phishing kits that proxy traffic between the victim and the legitimate service to harvest credentials and session cookies.
Detects evidence of ONYXC2 malware activity by correlating process-related events (mutex creation, remote thread injection, named pipes) with suspicious registry key or value modifications containing the 'ONYXC2' indicator within a 5-minute window.
Detects OfficeHome sign-in events featuring the 90014 error code (missing OAuth nonce). The rule looks for a specific mismatch where mobile browser User Agents are observed on a system reported as Windows 10, a pattern consistent with Adversary-in-the-Middle (AiTM) session token replay attacks attempting to access Microsoft 365 environments.
Detects anomalous access to email items containing financial keywords (e.g., payroll, invoice, banking) via 'MailItemsAccessed' events, characteristic of potential data collection following an AiTM (Adversary-in-the-Middle) account takeover. The rule identifies accounts accessing multiple financial emails without performing traditional BEC indicators such as creating inbox rules, modifying mailbox forwarding, or sending outbound phishing emails, which helps isolate silent exfiltration attempts.
Page 485 of 1168