Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detection rules designed to identify various stages of an Adversary-in-the-Middle (AiTM) phishing campaign, including malicious redirect chains (e.g., Google Meet/Ads redirects, AWS S3-hosted assets) and common lure patterns in SMTP traffic referencing voicemail portals.
Detection of suspicious DNS queries associated with Adversary-in-the-Middle (AiTM) phishing infrastructure. The rules monitor for suspicious subdomains and TLD patterns targeting Microsoft login services, as well as behavioral sequences involving initial Google Ads traffic redirection followed by rapid lookups of suspected malicious or newly registered domains and external geolocation services.
Detects the abuse of the Google Meet 'linkredirect' service to facilitate phishing attacks, commonly used to bypass security filters and redirect users to Adversary-in-the-Middle (AiTM) phishing landing pages.
Detects Microsoft 365 / Entra ID sign-in events where the reported client application is Microsoft Outlook but the User-Agent string is inconsistent with Outlook's standard Edge-based WebView. This behavioral discrepancy often indicates the use of automated HTTP clients to replay stolen session tokens in Adversary-in-the-Middle (AiTM) phishing campaigns, allowing attackers to maintain authenticated access for reconnaissance and data collection.
Detects the creation or modification of O365 inbox rules designed to move incoming emails to the 'Deleted Items' folder, delete messages, or mark them as read. This behavior is a common indicator of an adversary attempting to hide phishing lures, security alerts, or C2 communications within a compromised mailbox.
Detects outbound HTTP requests to api.telegram.org containing 'sendMessage' patterns in the URI and suspicious query parameters like 'VIEW' or 'MOBILE'. This behavior is characteristic of malicious scripts or applications using the Telegram Bot API as a command-and-control (C2) or exfiltration channel.
Detects Microsoft Entra OAuth 2.0 device authorization grant flow completion immediately followed by non-interactive API access from automated user agents like python-requests. This behavior is indicative of device code phishing kits, where an attacker tricks a user into entering a code and then programmatically hijacks the resulting session token.
Detects rapid, non-interactive sign-ins to the Microsoft Device Registration Service following a device-code authentication. This pattern is characteristic of attackers using scripted clients (such as python-requests) to automate the registration of rogue devices after harvesting tokens via device-code phishing.
Detects outbound network traffic from internal hosts to the known MoneroOcean mining pool over TLS (port 443). This behavior is indicative of XMRig or other cryptomining software communicating with a mining pool to exchange job data, often a sign of unauthorized resource hijacking.
Detects network activity associated with SilkParasite infrastructure, including the use of specific self-signed TLS certificates (swarm ca, proxy.local, 127.0.0.1) and connections to known malicious pivot domains such as socket.ayakliborsa.net or certificate subjects like *.scalefast.ninja.
Page 486 of 1168