Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects HTTP POST requests from Android devices identified as RatHat malware, specifically targeting exfiltration of sensitive data including credentials, cipher keys, and ADB certificate/key uploads via the malware's C2 API.
Detects the HEAVYGRAM malware utilizing the Telegram Bot API to download file attachments, followed by the extraction of an archive using PowerShell to a masqueraded directory (C:\ProgramData\Kee_Pass), and the subsequent execution of a binary masquerading as KeePass.exe.
Detects outbound network connections over TCP port 445 directed toward common internal IP address ranges (RFC 1918) by processes other than standard system binaries. This pattern is characteristic of SMB network scanning or lateral movement activities, such as those used by the DragonForce locker ransomware to discover target hosts within a network.
Detects the execution of AADInternals PowerShell toolkit commands. AADInternals is a known framework used for administration, enumeration, and exploitation of Azure Active Directory and Microsoft Entra ID, including the creation of backdoors and manipulation of federation settings.
This rule identifies sign-in events or alerts that are explicitly flagged by security intelligence as originating from IP addresses associated with known malicious or attacker infrastructure.
Detects successful sign-ins where Multi-Factor Authentication (MFA) was approved using the 'PhoneAppOTP' method, specifically where the method was registered by the user prior to the observed sign-in timeframe. This pattern can indicate an adversary using an actor-controlled MFA device registered previously to maintain persistent access to a compromised account.
This rule monitors Microsoft Graph API audit logs for suspicious patterns indicative of automated discovery or enumeration of SharePoint and OneDrive environments. It detects high-frequency access to sensitive API endpoints (such as /sites, /drives, or /children) and the use of pagination parameters (skiptoken, top) within short time intervals, which are common techniques used to crawl and inventory organizational data at scale.
This rule monitors Microsoft Graph API audit logs for suspicious patterns indicative of automated discovery or enumeration of SharePoint and OneDrive environments. It detects high-frequency access to sensitive API endpoints (such as /sites, /drives, or /children) and the use of pagination parameters (skiptoken, top) within short time intervals, which are common techniques used to crawl and inventory organizational data at scale.
Detects anomalous high-volume access to Exchange Online via the One Outlook Web/Office client, potentially indicating data exfiltration or automated mass email access by a compromised account.
This rule detects potential reconnaissance activity within a Microsoft Entra ID (Azure AD) environment by monitoring Microsoft Graph API audit logs. It specifically flags accounts that exhibit high-frequency access to sensitive endpoints related to directory roles, role management, authentication methods, service principals, and application permissions. The detection triggers when an identity interacts with multiple distinct sensitive API paths within a 30-minute window, a pattern indicative of an adversary enumerating privileges, MFA configurations, or application consent settings for potential escalation or persistence.
Page 550 of 1168