Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects specific authentication failure codes (50074, 50140) associated with MFA bypass and session persistence interruptions, which are characteristic of Adversary-in-the-Middle (AiTM) phishing attacks targeting modern authentication flows.
Detects DNS resolution requests for the domain 'myaccount.microsoft.com', which is the Microsoft account management portal. This activity is often associated with legitimate user authentication or account configuration processes, but can be used as part of reconnaissance or credential-related activities.
Detects DNS lookups and TLS SNI requests to known domains associated with Storm-3121 and Storm-3032 phishing campaigns. These campaigns utilize passkey or Single Sign-On (SSO) themed lures to facilitate credential harvesting.
Detects file access or download operations performed by the python-httpx library within a specific cloud application context, which may indicate automated data retrieval or exfiltration attempts by scripts or custom tools.
This rule detects the addition of new multi-factor authentication (MFA) methods to an Azure AD or Entra ID user account. Adversaries often register new MFA methods (such as phone numbers or authenticator apps) to accounts they have compromised, enabling them to bypass existing MFA requirements and maintain persistent access to the target environment.
Detects any successful login event for a user in an Azure AD environment. The rule acts as a coarse proxy for potential device-code grant-type authentication, pending the availability of more granular protocol and grant-type fields in the environment's telemetry.
Detects the execution of Acronis management or recovery tools (associated with cPanel, WHM, or Plesk environments) by a non-root user that results in a process running with root privileges. This pattern is indicative of potential privilege escalation by exploiting vulnerabilities in service-level utilities.
Detects usage of the 'One Outlook Web' application (ApplicationId 20893) to access Microsoft 365 Exchange REST APIs. This activity is a potential precursor to high-volume mailbox data exfiltration and should be monitored for volumetric anomalies.
Detects instances where a large volume of data (greater than 5GB) is transferred through an anonymous proxy using specific cloud application IDs. This pattern is indicative of potential data exfiltration via third-party or obscured network channels.
Detects instances where a non-root user executes commands containing 'acronis' alongside web hosting management keywords (cpanel, whm, plesk) while the target process user is 'root'. This behavior suggests an attempt to abuse backup software or administrative management tools to escalate privileges or perform unauthorized administrative actions.
Page 543 of 1168