Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous reconnaissance activity targeting sensitive Microsoft Graph control-plane endpoints, including directory roles, MFA settings, application registrations, service principals, and OAuth consent configurations. The rule identifies high-volume access across multiple distinct sensitive endpoints within a short time frame, which is indicative of an adversary enumerating infrastructure to identify opportunities for privilege escalation, persistence, or bypass of security controls.
Detects anomalous authentication behavior where a user successfully completes an OAuth device-code grant, followed by a subsequent login event using the same user context but originating from a different source IP address. This pattern is indicative of device-code phishing, where an adversary tricks a user into authorizing a device, then uses the resulting session or token from their own infrastructure.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects DNS queries and TLS SNI traffic directed towards known malicious domains associated with passkey and SSO phishing campaigns, specifically attributed to Storm-3121 and Storm-3032. These domains are used to deceive users into providing credentials or authentication tokens via fraudulent login portals.
Detects high-frequency requests to Microsoft Graph API endpoints related to messages, mailFolders, or attachments, indicative of an adversary performing mailbox reconnaissance or data collection via cloud APIs.
Detects anomalous, high-volume activity directed at SharePoint and OneDrive Graph API endpoints (e.g., /sites, /drives, /search, /children). The activity pattern, characterized by multiple distinct path requests and the usage of pagination tokens within a short timeframe, strongly indicates an adversary attempting to map the file structure and contents of a repository prior to data collection or exfiltration.
This rule detects high-volume file access, preview, or download activity from SaaS applications (SharePoint, OneDrive, Exchange Online) originating from IP addresses classified as anonymous proxies. The threshold is set to 1000 events within a 2-hour window, which is indicative of automated, high-speed data exfiltration rather than standard user behavior.
Detects anomalous, high-volume enumeration of SharePoint and OneDrive resources via Microsoft Graph API by monitoring for repeated access patterns involving /sites, /drives, or /drive endpoints combined with search, directory traversal, and pagination parameters.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Page 553 of 1168