Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a successful user authentication event following a Microsoft OAuth 2.0 device authorization grant flow. This detection identifies scenarios where a user may have been phished into entering an attacker-supplied device code on a malicious Microsoft device login page, resulting in the attacker successfully obtaining OAuth tokens.
Detects the presence of the modular C# backdoor framework known as Stella_Gary, used by the Kimsuky (APT-C-55) threat group. The rule identifies specific namespace and class strings associated with the framework within .NET executable files.
This rule detects potential BabylonRAT C2 beaconing activity by monitoring for recurring outbound HTTP GET requests using a 'Firefox' User-Agent string on non-standard HTTP ports. The threshold mechanism specifically flags repeated connections within a short time frame, which is characteristic of malware beaconing behavior.
Detects Windows PE files exhibiting characteristics of BabylonRAT, specifically the use of dynamic API resolution via GetProcAddress and LoadLibrary to hide imports, combined with XOR-obfuscated strings for sensitive functions like CreateProcess, WriteFile, and InternetOpen to evade static analysis.
Detects anomalous device registration activity where a single user principal registers three or more distinct devices within a short duration (2 minutes). This behavior is characteristic of device-code phishing attacks where adversaries abuse stolen device authorization codes to register multiple rogue devices, potentially for PRT (Primary Refresh Token) acquisition.
Detects malicious OAuth 2.0 device authorization grant requests directed at Microsoft services. This rule identifies usage of specific App IDs associated with the Microsoft Authentication Broker combined with the 'offline_access' Graph scope, a pattern indicative of GhostCode-style phishing campaigns designed to steal access and refresh tokens.
Detects a suspected device code phishing (GhostCode) attack where a user authenticates via a device code flow, followed within 10 minutes by a non-interactive authentication request originating from a client utilizing the 'python-requests' user agent. This pattern is indicative of an adversary abusing a stolen device token to gain access to cloud resources.
Detects the execution of 'OrionQuests-Setup.exe' followed by the creation of a shortcut (.lnk) file by the same process. This activity is a known indicator of the Kimsuky (APT-C-55) Stella_Gary infection chain, where a disguised installer drops malicious shortcuts to facilitate further execution.
Detects the execution of a process named 'firefox.exe' from a directory other than the standard Mozilla Firefox installation path ('C:\Program Files\Mozilla Firefox' or 'C:\Program Files (x86)\Mozilla Firefox'). This behavior is commonly associated with the BabylonRAT malware, which masquerades as the legitimate Firefox browser to hide its presence and facilitate initial infection.
Detects the execution of a process named 'firefox.exe' from a directory other than the standard Mozilla Firefox installation path ('C:\Program Files\Mozilla Firefox' or 'C:\Program Files (x86)\Mozilla Firefox'). This behavior is commonly associated with the BabylonRAT malware, which masquerades as the legitimate Firefox browser to hide its presence and facilitate initial infection.
Page 560 of 1168