Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects login events to the 'My Sign-Ins' portal (mysignins.microsoft.com) by users. This portal is a high-value target for adversaries who have gained access to a session via token theft or session hijacking, as it allows them to modify or add authentication methods (such as MFA devices) to establish long-term persistence in the victim's account.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects DNS queries, TLS SNI, and HTTP Host header traffic directed towards known phishing domains associated with Storm-3121/Storm-3032 infrastructure. These domains often use themes related to passkey setup, SSO, or account security to trick users into providing credentials.
Detects automated file access and download operations in SharePoint or OneDrive performed by the 'python-httpx' library. This behavior may indicate an attacker using scripts or automated tools to perform unauthorized data collection or exfiltration, often observed in automated cloud compromise scenarios.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects executable file downloads initiated by common web browsers where the associated Zone.Identifier (Mark-of-the-Web) file lacks a ReferrerUrl. This pattern is often used by malware to conceal the source of a payload, potentially indicating a direct download or a hidden link redirection that bypassed standard referral tracking.
Detects a single Azure AD identity successfully authenticating from three or more unique IP addresses within a 24-hour window. This behavior is indicative of infrastructure rotation by threat actors, such as those observed in Storm-3121/Storm-3032 campaigns, intended to evade network-based detection and conditional access controls during reconnaissance or exfiltration phases.
Detects anomalous authentication behavior where a user successfully completes an OAuth device-code grant, followed by a subsequent login event using the same user context but originating from a different source IP address. This pattern is indicative of device-code phishing, where an adversary tricks a user into authorizing a device, then uses the resulting session or token from their own infrastructure.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Page 552 of 1168