Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects anomalous interaction with the Microsoft Graph API by monitoring for high-frequency requests across multiple functional categories (e.g., tenant, directory, privilege, application, repository, mailbox) from a single identity. A large number of distinct API paths across multiple categories in a short time frame is indicative of an attacker performing reconnaissance or automated environment enumeration.
This rule detects high-frequency network activity directed toward the Microsoft Graph API (graph.microsoft.com) utilizing the 'python-httpx' user agent. This pattern matches known exfiltration activity associated with Storm-3121/Storm-3032 threat groups, where automated scripts are used to move data out of the environment via legitimate cloud service APIs.
Detects potential installation of compromised Admin Menu Editor Pro plugin updates by identifying sequential download events for specific plugin versions from the 'adminmenueditor.com' domain within a 24-hour window. This behavior is indicative of a supply chain attack where a legitimate update mechanism is leveraged to deliver malicious payloads without integrity verification.
Detects the addition of a new Multi-Factor Authentication (MFA) method for a user account shortly after a suspicious or risky login attempt (e.g., unfamiliar features, risk states, or unusual network locations). This pattern is consistent with an adversary attempting to establish persistent access by registering their own MFA device to a compromised account.
Detects a sequence of events where a user performs a sign-in from an unmanaged or mobile device while interacting with applications often associated with MFA or SSO prompts (indicative of a social engineering lure), followed by an administrative update to register a new authentication method within 30 minutes. This pattern is characteristic of attackers establishing persistent access to an account by adding their own MFA device.
This rule monitors DNS queries and TLS SNI traffic for connections to domains that appear to be performing typosquatting, specifically targeting users by impersonating SSO and Passkey service providers. These domains mimic legitimate security portals to facilitate credential harvesting.
Detects anomalous activity in Azure AD/Microsoft Graph API logs, where a specific user or application performs a high volume of requests across multiple sensitive administrative categories (such as directory roles, authentication methods, applications, and service principals) within a 30-minute window. This behavior is often indicative of reconnaissance or privilege escalation attempts by an adversary who has compromised an identity.
Detects internal phishing messages sent via Microsoft Teams that contain common credential-harvesting lures (e.g., passkey, MFA, SSO updates) where the sender account has also exhibited indicators of compromise within the preceding 24 hours, such as risky sign-ins or impossible travel.
Detects high-frequency TLS sessions initiated from internal hosts to Microsoft identity, Graph API, and account management endpoints. This behavior often mimics legitimate interaction but may indicate an adversary rotating infrastructure, automating reconnaissance, or interacting with C2 channels disguised as legitimate SaaS traffic.
Detects DNS queries for suspicious domains that use keywords typically associated with credential harvesting, passkey-based phishing, or rogue SSO/authentication portal setups. The rule flags domains containing terms like 'passkey', 'oktasession', 'keysync', and various 'setup' or 'connect' variations designed to deceive users into providing authentication credentials.
Page 542 of 1168