Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a single process accessing multiple distinct sensitive files related to cryptocurrency wallets, SSH keys, or seed phrases within a short duration. This pattern of bulk file access is highly indicative of automated credential harvesting modules like those found in the CRPx0 malware family.
Detects device-code OAuth authentication flow abuse against Microsoft 365 accounts, identified by sign-ins to Microsoft Authentication Broker with originalTransferMethod=deviceCodeFlow, correlated for repeated attempts on the same account within a short window
Detects network and DNS traffic targeting known infrastructure used by the Forg365 adversary-in-the-middle (AiTM) phishing kit. This kit clones Microsoft login pages to intercept credentials and session cookies via reverse proxy.
Detects Microsoft Entra device registration events where the device name adheres to the 'Forg365-' prefix naming convention. This pattern is indicative of persistence mechanisms used by the Forg365 Phishing-as-a-Service (PhaaS) platform, which registers devices to bypass conditional access or MFA.
Detects continued non-interactive Microsoft Graph session activity for a user account from an IP address different from the one used during a password reset event, consistent with replayed refresh-token or session-cookie material persisting through credential rotation.
Detects post-compromise mailbox operations consistent with Forg365 BEC monitoring: new inbox/mail-forwarding rule creation, keyword listener/alert configuration, viewer-link creation for shared inbox access, or M365 mailbox search activity following account takeover
AiTM Phishing - PHPSESSID Cookie with Preload Flag and Word-Number Route Token
Detects outbound network traffic to the 'logfriend[.]com' domain, specifically to endpoints used by the Forg365 'ForgCookie' browser extension. This extension is known to facilitate the automated refreshing of Microsoft SSO cookies, potentially enabling persistent session hijacking and bypassing MFA.
Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.
Detects anomalous network traffic patterns targeting FortiClient EMS systems, specifically on port 8013. This pattern is indicative of exploitation attempts related to CVE-2026-35616, where an external entity communicates with a vulnerable FortiClient EMS instance multiple times in a short window.
Page 568 of 1168