Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
Detects individual access events to sensitive Microsoft Graph control-plane endpoints, including directory roles, role management, authentication methods, applications, service principals, and OAuth permissions. This rule is designed to be paired with a broader correlation rule to identify potential reconnaissance or persistence activities involving high-privilege configuration changes.
This rule detects cloud file access (Download, Accessed, or Sync) originating from a Python-based user-agent (python-httpx) associated with specific Microsoft 365 applications, flagged by either an uncommon ISP or an uncommon user-agent for that specific user. This behavior is indicative of potential automated data collection or exfiltration attempts using programmatic access against cloud storage services.
This rule detects successful sign-in attempts to Azure AD (Entra ID) using the Device Code authentication protocol. Device Code flow allows users to sign in to input-constrained devices by using a browser on another device. While legitimate for smart TVs, IoT devices, or CLI tools, this flow is frequently abused by attackers to perform phishing or bypass MFA by tricking users into authorizing an application.
Detects changes to user authentication methods, such as activating software tokens, registering new security information, or changing MFA configuration. This activity can indicate an adversary attempting to modify MFA settings to maintain persistent access or bypass account security controls.
Detects high-volume outbound network traffic (exceeding 100MB) generated by processes identifying as 'python-httpx' to non-internal IP addresses. This activity is often associated with automated data exfiltration using Python-based tools.
This rule aggregates Azure AD sign-in logs for a specific application, grouping by user principal name, IP address, location, and device ID. It provides a baseline view of user authentication patterns to identify unusual sign-in activity such as anomalous login locations or device usage.
Detects network activity related to the SilverFox modular malware framework, including relay/dispatcher discovery, contact with known C2 infrastructure (noah-ssh.com.cn and Cloudflare Workers), and specific HTTP response patterns associated with its relay discovery process.
This rule detects a correlation between an incoming email, SMS, or message containing phishing lure keywords related to 'passkey' or 'SSO' and 'update' requests, followed by a successful or attempted user sign-in from that recipient within a 2-hour window. This behavior is indicative of a social engineering campaign aimed at credential or token theft.
Page 521 of 1168