Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors network connections and DNS queries directed towards Microsoft's OAuth device code authorization endpoints ('/common/oauth2/deviceauth' or '/device'). This flow is frequently abused by adversaries to perform device code phishing, allowing them to gain access to a victim's account without requiring the user's password or bypassing traditional MFA.
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
Detects the execution of an LNK file that initiates a command chain resulting in an encoded PowerShell script. This behavior is indicative of malicious shortcut files often used in initial access to trigger multi-stage payloads, consistent with techniques observed in Kimsuky-linked infection chains.
Detects the execution of a .lnk file that directly triggers a PowerShell process. This behavior is frequently associated with malicious shortcut files used in initial access and execution, such as those observed in Kimsuky (APT-C-55) infection chains where disguised installers drop LNK files that execute PowerShell scripts for anti-analysis and subsequent payload deployment.
Detects phishing emails associated with the 'GhostCode' campaign, which uses an NDA or Supplier NDA Agreement pretext combined with WeTransfer links. The rule identifies suspicious emails by correlating the lure content with additional indicators such as specific lookalike sender domains, VoIP contact numbers, hardcoded ZIP passwords, or HTML attachments.
Detects suspicious OAuth device code authorization requests matching the GhostCode phishing kit's pattern. The rule identifies the use of a known Microsoft Authentication Broker App ID (29d9ed98-a469-4536-ade2-f981bc1d605e) coupled with the 'python-requests' user agent, which are characteristic indicators of the phishing backend server attempting to authorize malicious requests.
This rule detects successful authentication events using the Microsoft OAuth device code flow, which is often abused in phishing campaigns to hijack user sessions. It flags authentication attempts that match specific device authorization URLs, include signs of bypassing security warnings, or indicate a lack of direct user authentication interaction.
Detects execution of PowerShell spawned by suspicious processes (e.g., installers or Windows Explorer) involving LNK file patterns or suspicious command-line obfuscation techniques commonly associated with Kimsuky (APT-C-55) activity.
Detects the use of common command-line utilities to search for sensitive files, including credential files (.env, credentials.json, database.yml), wallet files (wallet.dat), and mnemonic/seed phrases. This activity is often associated with reconnaissance for credentials or sensitive data on compromised Linux systems.
This rule monitors for potential suspicious database operations executed via MySQL command-line utilities. It specifically detects the use of the AES_ENCRYPT function in conjunction with UPDATE statements, which is a technique often used by ransomware to encrypt database tables or data.
Page 498 of 1168