Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized modification of file permissions on Acronis-related files or directories, or modification of Acronis-related files by non-authorized users. This rule targets attempts to weaken file security (e.g., setting permissions to 777 or 666) or unauthorized tampering with Acronis components, which may be part of an attempt to gain persistence, escalate privileges, or evade detection.
Detects DNS resolution attempts for graph.microsoft.com by processes other than standard web browsers or mail clients. This activity is indicative of scripted tools or malicious software attempting to enumerate or access Microsoft 365 mailbox content via the Graph API, bypassing normal user interaction.
Detects a multi-stage sequence of network connections to Microsoft cloud services (login.microsoftonline.com, graph.microsoft.com, and data exfiltration endpoints like sharepoint.com) consistent with Storm-3121/Storm-3032 adversary activity. This rule is designed for IDS/IPS monitoring of traffic patterns indicating authentication, reconnaissance, and potential data exfiltration from Microsoft 365 environments.
Detects when a user identity in Azure AD has a new software OTP token activated, specifically marked with property flags indicating a placeholder or new device enrollment. This behavior can be indicative of an adversary registering a new, attacker-controlled MFA device to maintain persistent access to a compromised account.
Detects Microsoft Teams messages containing urgent language and themes related to passkey or SSO updates, which are indicative of a phishing attempt aimed at harvesting credentials or performing account takeover.
Detection of DNS queries, TLS SNI, and HTTP Host headers matching domains associated with Storm-3121 and Storm-3032 phishing campaigns. These campaigns mimic identity, SSO, and passkey registration processes to capture credentials or perform token theft.
Detects obfuscated PHP web shell activity within the Admin Menu Editor Pro plugin, specifically looking for common obfuscation patterns like base64_decode, gzinflate, and str_rot13 combined with encoded payloads.
Detects high-volume file download or data access events across SharePoint, OneDrive, and Exchange Online. This rule monitors for requests from Python-based HTTP libraries (httpx, requests, urllib) targeting Microsoft Graph API endpoints, which is a pattern indicative of automated bulk data collection or exfiltration, often observed in campaigns like Storm-3121 or Storm-3032.
Detects user authentication events that exhibit patterns consistent with Adversary-in-the-Middle (AiTM) phishing campaigns, specifically those leveraging passkey or SSO-themed lures and device-code authentication flows.
Detects a sequence of user activities—authentication, MFA registration, Graph API reconnaissance, and data exfiltration—originating from a rotating set of distinct source IP addresses for the same user within a 24-hour period. This behavior is indicative of coordinated infrastructure rotation tactics used by threat actors in cloud intrusions.
Page 544 of 1168