Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous, high-volume mailbox access across multiple distinct Exchange Online mailboxes within a short timeframe (1 hour) initiated by a single user account. This behavior is indicative of automated email reconnaissance, content scraping, or bulk exfiltration, often associated with post-credential compromise activity where an attacker iterates through mailboxes to identify sensitive information such as financial or administrative data.
Detects high-volume, automated Pix transfer transactions within a short timeframe from a single source or session, which may indicate unauthorized use of a 'Pix' panel or automated financial fraud.
Detects the initialization of the SEE_MASK_NOZONECHECKS environment variable within a PowerShell process command line. Setting this variable to '1' is a known technique used to suppress Windows zone-based security prompts (Mark-of-the-Web) for downloaded files, facilitating the execution of potentially malicious payloads.
Detects a suspicious sequence of Microsoft-signed .NET binaries (regsvcs.exe, installutil.exe, msbuild.exe, aspnet_compiler.exe) spawned by a single parent process in a short timeframe. This behavior is indicative of an attacker cycling through multiple trusted binaries in a fallback strategy to bypass application allowlisting or endpoint protection controls.
Detects the termination of 'wscript.exe' using 'taskkill.exe' or PowerShell 'Stop-Process'. This behavior is commonly used by malicious loaders to stop script-based execution after a payload has been staged or executed to minimize forensic artifacts and potential detection by defenders monitoring long-running processes.
Detects network traffic (DNS queries, HTTP requests, and TLS SNI) directed towards the domain 'htlwub00klocate.blogspot.com', which is associated with adversary staging activity.
Detects the Windows Script Host (wscript.exe or cscript.exe) executing files with suspicious double extensions, specifically those mimicking PDF documents (e.g., .pdf.js) or utilizing the .jse extension. This pattern is commonly associated with fileless initial execution lures, often seen in ClickFix-style or VEIL#DROP campaigns designed to trick users into executing malicious scripts.
Detects unauthorized cloud authentication attempts in Azure AD where a session token appears to have been replayed. The rule identifies sign-ins flagged by Identity Protection as anomalous or involving token/issuer irregularities, particularly when these occur without a fresh MFA challenge, suggesting a bypass of standard authentication controls.
Detects the use of .NET reflection APIs, such as Assembly.Load or Reflection.Emit, within PowerShell command lines. This technique is commonly used to load and execute malicious code entirely in memory, facilitating fileless malware execution and bypassing traditional disk-based security controls.
Detects anomalous access to sensitive Microsoft Graph API endpoints (messages, mailFolders, contacts) following a device-code authentication. The rule specifically flags activity from non-standard or generic client applications, which is a pattern often associated with post-compromise proxying or token abuse, such as the 'ARToken' technique.
Page 506 of 1168