Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
Detects inbound emails impersonating IT support or helpdesk staff that utilize urgent pretexts related to passkey, MFA, or SSO updates. These lures are commonly used in phishing campaigns to direct users toward malicious authentication flows, such as AiTM or device-code phishing setups.
Detects high-volume, automated file download or access activity originating from SharePoint Online, OneDrive, or Exchange Online within a 2-hour window. The rule identifies suspicious patterns involving a large number of distinct file events, potentially indicating automated scripts or tools (like python-httpx) performing mass data collection or exfiltration.
Detects high-volume, automated file download or access activity originating from SharePoint Online, OneDrive, or Exchange Online within a 2-hour window. The rule identifies suspicious patterns involving a large number of distinct file events, potentially indicating automated scripts or tools (like python-httpx) performing mass data collection or exfiltration.
Detects a single user account sending an unusually high volume of Microsoft Teams messages containing themes related to passkey, SSO enrollment, or security updates. This behavior is indicative of a compromised internal account being leveraged to propagate social engineering lures to other employees.
Detects a suspicious sign-in sequence indicative of an Adversary-in-the-Middle (AiTM) phishing attack. The rule identifies a user attempting to sign in from an unmanaged device (triggered by Azure AD error 50074, requiring secondary authentication) followed shortly by an interruption in session persistence (triggered by error 50140) while using a browser user agent, suggesting the session is being relayed through a malicious proxy.
This rule detects potential identity compromise via abuse of the OAuth device-code grant flow. It monitors for successful user logins leveraging the device code flow, which is a common indicator of AiTM (Adversary-in-the-Middle) phishing campaigns that lure users into authorizing malicious applications under pretexts like security updates or SSO re-authentication.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
Page 525 of 1168