Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects high-frequency and broad-scope enumeration of multiple Microsoft Graph API endpoints by a single identity. By monitoring for access to diverse sensitive categories (organization, users, groups, directoryroles, sites, messages) within a short timeframe, it flags activity patterns consistent with reconnaissance, account discovery, or unauthorized data exploration.
This rule detects suspicious cloud user activity by identifying a single user account engaging in diverse, multi-stage actions (Authentication, MFA updates, Reconnaissance, and Exfiltration) originating from a high number of distinct source IP addresses. This behavioral pattern is indicative of a compromised account where an adversary is rotating IPs while performing a coordinated, multi-stage attack sequence.
This rule detects anomalous, high-volume file access or download activity across cloud applications and file storage services. It tracks users over a period of time, flagging individuals whose daily activity consistently contributes to a large total volume of data access (exceeding 500MB) over at least five days, specifically looking for sustained behavior that deviates from sudden, single-day spikes.
Detects potential social engineering attacks in Microsoft Teams where an internal user sends multiple messages containing terms related to MFA, SSO, or passkey updates, potentially attempting to harvest credentials from other users.
Detects outbound HTTP requests to known domains or domains following a specific URI pattern associated with the delivery of SilverFox malware payloads.
This rule detects potentially malicious or automated data access patterns within Microsoft 365 or similar cloud environments. It identifies user accounts or applications that exhibit a high volume of file/email access operations across a diverse set of paths, which is often indicative of automated data exfiltration, scraping, or suspicious collection by a compromised identity.
Detects network traffic (TLS SNI or HTTP Host) to known domains associated with Adversary-in-the-Middle (AiTM) phishing campaigns. These domains mimic passkey, SSO, or account security portals to steal credentials and session cookies.
Detects potential abuse of the device-code authentication flow, which is often used in AiTM (Adversary-in-the-Middle) phishing campaigns. The detection looks for device-code authentication attempts followed by specific error codes (50074, 50140) commonly associated with failures in malicious passkey-themed phishing workflows.
Detects cloud data access or file download operations in Microsoft 365 (SharePoint, OneDrive, Exchange) performed by a user agent string associated with the python-httpx library. This pattern is often indicative of automated data exfiltration using custom scripts.
Detects the registration of a new MFA or security information method (such as StrongAuthenticationMethod, phone, or software OTP token) on an Azure AD/Entra account. This activity is often consistent with attacker-controlled MFA enrollment, used to maintain persistent access after an initial identity compromise, such as one resulting from passkey-themed phishing.
Page 522 of 1168