Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects DNS queries and TLS SNI traffic related to known malicious domains used by threat actor groups Storm-3121 and Storm-3032 in passkey-themed phishing campaigns.
Detects multiple failed multifactor authentication (MFA) attempts from the same user on an unmanaged device. This behavior is indicative of an adversary attempting to bypass MFA or perform MFA fatigue attacks using stolen credentials.
Detects incoming emails containing subject lines, body text, or URLs related to passkey, SSO, or MFA configuration updates. These indicators are often used in social engineering campaigns to lure users into providing credentials on fraudulent login pages.
Detects modifications to a user's Azure Active Directory (Entra ID) account involving the addition of a new MFA authentication method or device, such as software tokens or mobile devices. This activity is often performed by an adversary to establish persistence by registering a device they control for future authentication bypass.
Detects high-frequency requests to various Microsoft Graph API endpoints, such as users, groups, applications, and mailboxes, within a short timeframe. This behavior is indicative of an adversary attempting to map out a target's cloud identity infrastructure and environment, often as a precursor to more focused attacks like phishing, data exfiltration, or lateral movement within M365.
Detects high-volume file access and download operations in SharePoint Online and OneDrive where the user agent is identified as 'python-httpx'. This behavior is indicative of automated exfiltration scripts potentially used in malicious cloud intrusion campaigns.
Detects anomalous network traffic patterns where internal assets interact with Microsoft Graph API and Entra ID (login.microsoftonline.com) authentication endpoints from distinct external destination IPs within a short time window. This behavior is indicative of potential attacker infrastructure rotation during C2 or post-authentication phases.
Detects a single identity, application, or IP address performing Graph API requests across multiple disparate categories (e.g., tenant, directory, privilege, application, repository, mailbox) within a short window. This pattern is indicative of automated reconnaissance or tenant enumeration, commonly performed during the post-compromise phase to map the environment prior to exfiltration.
Detects outbound network traffic from internal hosts to the Microsoft Graph API (graph.microsoft.com) originating from Python HTTP clients (requests or urllib libraries). This pattern can indicate automated data exfiltration from an internal environment to a cloud-based service, or the use of Microsoft Graph API for command and control purposes.
This rule detects network traffic directed at a potentially compromised server associated with the Admin Menu Editor Pro plugin, specifically looking for HTTP requests that indicate an attempt to download a malicious update.
Page 566 of 1168