Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious Microsoft Intune device enrollment activities characterized by the use of a spoofed User-Agent (matching Microsoft Office/Outlook strings) and rapid, multiple enrollment attempts within a short timeframe. This behavior is associated with adversary use of device-code phishing kits to enroll rogue devices using stolen session tokens.
This rule detects potential abuse of the device code authentication flow by correlating a successful device code login with a subsequent non-interactive sign-in using the 'python-requests' user agent for the same user within 10 minutes. This behavior is indicative of an attacker programmatically accessing resources or APIs immediately after gaining authorization via a device code phishing or relay attack.
Detects rapid rotation of multiple unique IP addresses originating from the same user account shortly after a device code authentication event. This behavior is indicative of threat actors using proxy rotation services (like FlashProxy) to obfuscate their origin and bypass location-based security controls or impossible-travel detections after hijacking a session.
This rule searches for any process, image load, or file events containing the string 'Stella_Gary' within file names, folder paths, or process command lines. This is a generic hunting rule typically used to identify artifacts, indicators, or files associated with a specific entity or project codename.
This rule searches for any process, image load, or file events containing the string 'Stella_Gary' within file names, folder paths, or process command lines. This is a generic hunting rule typically used to identify artifacts, indicators, or files associated with a specific entity or project codename.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.
Detects instances where a process named firefox.exe, executing from the ProgramData directory, is used to establish persistence via Windows Registry Run keys or to create scheduled tasks/services. This behavior is indicative of a malicious process masquerading as the legitimate Firefox browser to maintain persistence on a host.
Detects unauthorized processes attempting to access sensitive web browser files (login data, cookies, configuration) located in Chrome or Firefox profile directories. The detection excludes known browser-related processes and system processes, focusing on third-party or potentially malicious utilities that could be used to harvest credentials stored in these local files.
This rule detects modifications to the Windows hosts file (C:\Windows\System32\drivers\etc\hosts). Adversaries often modify this file to redirect legitimate traffic to malicious IP addresses, a technique commonly used for command and control or phishing campaigns.
Page 557 of 1168