Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential reconnaissance activity against Microsoft Graph API endpoints, indicative of an adversary enumerating tenant resources such as users, groups, applications, and directory roles. It monitors for high volumes of diverse Graph API queries originating from a single user or application identity within a short time window, which is a common behavior pattern for automated discovery tools.
This rule monitors cloud and identity logs to detect a single user identity exhibiting multiple stages of suspicious activity (authentication, reconnaissance, and exfiltration) within a 24-hour period while utilizing distinct, non-overlapping source IP addresses for each stage. This behavior is indicative of an account compromise where different stages of the attack chain originate from different infrastructure.
This rule detects the creation of a new administrator account in WordPress within one hour of a specific plugin update event (specifically for the 'admin-menu-editor-pro' plugin). This pattern is indicative of a post-exploitation activity where a compromised or vulnerable plugin is used to gain administrative access to the WordPress instance.
Detects potential Adversary-in-the-Middle (AitM) activity where a user triggers both a standard MFA requirement (50074) and a subsequent MFA requirement within the same session (50140), potentially indicating the user is interacting with a proxy site that requires re-authentication or session interception. The rule specifically looks for users who trigger these events in short succession, often associated with phishing campaigns aiming to bypass MFA.
This rule identifies servers running an outdated and vulnerable version (1.9.3 HF3) of the Acronis Backup plugin within cPanel, WHM, or Plesk environments. This specific version is known to be vulnerable to CVE-2026-87886.
Detects instances where a user successfully authenticates using the OAuth 2.0 device code flow, and the resulting token is subsequently used from a different IP address or by a different client application, indicating potential token theft or session hijacking.
Detects modifications to a user's Azure Active Directory (Entra ID) authentication methods where a new authentication device is added. The rule specifically monitors changes to 'StrongAuthenticationPhoneAppDetail' or 'StrongAuthenticationUserDetails' and identifies instances where the count of registered devices increases, potentially indicating an attacker adding a device for persistence or MFA bypass.
Detects anomalous sign-in activity where a user triggers both Error Code 50074 (MFA required) and 50140 (MFA bypass occurred or not required/invalidated) in a short window of time (less than 1 hour). The rule looks for sessions on unmanaged devices (empty TrustType) using Chrome, which may indicate an adversary attempting to bypass or manipulate MFA enrollment or verification flows.
Detects the use of chmod, chown, or chattr to modify file permissions on paths related to backup (Acronis) or hosting management (cPanel, WHM, Plesk) software. Specifically monitors for command-line arguments indicating a change to world-writable permissions (e.g., 777, o+w, a+rwx) on sensitive configuration files.
Detects the use of chmod, chown, or chattr to modify file permissions on paths related to backup (Acronis) or hosting management (cPanel, WHM, Plesk) software. Specifically monitors for command-line arguments indicating a change to world-writable permissions (e.g., 777, o+w, a+rwx) on sensitive configuration files.
Page 501 of 1168