Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potentially malicious activity where a user performs a device code authentication followed by multiple rapid token exchanges (often of different types) within an extremely short time window. This pattern is indicative of an attacker attempting to leverage a compromised device code grant to programmatically retrieve access or refresh tokens before the user has completed a legitimate flow or to automate malicious access.
Detects instances where a user authenticates via the device code flow and subsequently performs a device enrollment or registration action from an unusual or non-compliant device naming convention. This pattern is indicative of an adversary enrolling their own device to bypass MFA or gain persistent access to corporate resources.
Detects the execution of a process named 'firefox.exe' that is running from a path other than the standard Mozilla Firefox installation directory. This is a common technique used by malware to masquerade as a legitimate web browser.
This rule detects processes named 'firefox.exe' running from locations other than the standard Mozilla Firefox installation directories. This behavior is often indicative of an adversary attempting to masquerade malicious activity by using a legitimate browser process name.
Detects unauthorized write, modification, or rename operations performed on the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) by processes that are not typically authorized for such activity, such as standard system processes (svchost, services, etc.).
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
Detects unauthorized processes attempting to access browser credential database files such as Login Data for Chromium-based browsers or logins.json and key4.db for Firefox. The rule filters out known browser processes to isolate potential credential harvesting or exfiltration activity.
This rule detects processes named 'firefox.exe' running from locations other than the standard Mozilla Firefox installation directories. This behavior is often indicative of an adversary attempting to masquerade malicious activity by using a legitimate browser process name.
Detects unauthorized write, modification, or rename operations performed on the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) by processes that are not typically authorized for such activity, such as standard system processes (svchost, services, etc.).
Page 555 of 1168