Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,341 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous sign-in behavior using the OAuth 2.0 device code authorization flow. The rule identifies sign-ins from previously unseen geographic locations or IP ranges (ASN) for a specific user, or detects a potential tenant-wide phishing campaign where multiple users are performing device-code authentications in a short timeframe, which is characteristic of 'device code phishing' (a form of OAuth consent phishing).
Detects anomalous sign-in behavior using the OAuth 2.0 device code authorization flow. The rule identifies sign-ins from previously unseen geographic locations or IP ranges (ASN) for a specific user, or detects a potential tenant-wide phishing campaign where multiple users are performing device-code authentications in a short timeframe, which is characteristic of 'device code phishing' (a form of OAuth consent phishing).
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Detects the creation of new programmatic credentials (AWS access keys, Azure AD service principal credentials, or GCP service account keys) where the identity creating the credential differs from the identity for which the credential is being issued. This behavior is often indicative of persistence mechanisms or credential abuse where an attacker with sufficient permissions creates secondary credentials for other accounts.
This rule detects the creation or modification of recurring cloud automation tasks (AWS EventBridge rules, Azure Automation Runbooks/Logic Apps, and GCP Cloud Scheduler jobs). Adversaries leverage these features to establish persistent access to a cloud environment by ensuring malicious code or scripts execute automatically, even after initial compromised credentials have been revoked.
Detects modifications to cloud-based IAM trust policies or resource policies that grant access to an external account, tenant, or project. This activity can indicate an attacker attempting to establish persistent backdoor access via cross-account trust relationships, bypassing standard identity controls.
Detects modifications to cloud security guardrails including AWS Service Control Policies (SCPs), Azure Policy assignments/exemptions, and GCP Organization Policies. These actions may indicate an attempt to disable security controls or weaken organizational policy enforcement.
Detects successful cloud console login events across AWS, Azure, and GCP where multi-factor authentication (MFA) was not utilized, combined with impossible travel indicators (login from different countries within an 8-hour window for the same principal).
Page 70 of 1168