Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,351 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
Detects a sequence where an OAuth application is granted 'Mail.ReadWrite' or 'MailboxSettings.ReadWrite' permissions, followed shortly thereafter (within 4 hours) by the creation or modification of an Inbox Rule by that same application within the same mailbox. This pattern is indicative of a persistence mechanism where an adversary uses elevated OAuth permissions to manipulate mailbox mail flow rules for stealth or exfiltration.
This rule monitors Office 365 management logs for device registration or join events in Azure Active Directory where the resulting device state is flagged as both non-compliant and unmanaged, despite having a 'Workplace' or 'AzureAd' trust type. It further aggregates these events by user to identify potential suspicious patterns, such as bulk registrations or rapid activity within a 30-minute window, which may indicate account compromise or unauthorized device enrollment.
No description available.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling policies, switching them to report-only mode, removing Multi-Factor Authentication (MFA) or grant control requirements, or expanding exclusion lists to exempt users, groups, or locations from security controls. Such modifications are often indicative of an adversary attempting to maintain persistent access or bypass MFA requirements.
Detects a potential Primary Refresh Token (PRT) or device code phishing attack by identifying a two-step authentication sequence: first, a successful user sign-in via device code flow, followed shortly by a subsequent sign-in from a different, unmanaged, or untrusted device. This behavioral pattern often indicates an adversary using stolen device code session data to authenticate a new device session.
Detects the assignment of highly privileged Azure AD/Entra ID directory roles (e.g., Global Administrator, Application Administrator) to a service principal. Assigning such roles to service principals is a common persistence technique, as these identities can be used to bypass conditional access policies and MFA through non-interactive authentication methods like client credentials.
Detects mass-phishing consent campaigns by monitoring non-admin users consenting to multi-tenant or unverified-publisher applications requesting non-basic-profile OAuth scopes. The rule aggregates multiple consent events for the same application over a 1-hour window to identify potentially malicious consent-phishing activity.
Detects anomalous behavior where a node.exe process establishes an outbound network connection, characteristic of a C2 registration or ping loop, followed shortly by the spawning of an interactive command shell (cmd.exe or powershell.exe) by the same node.exe process. This pattern is indicative of a RAT (Remote Access Trojan) shell handler execution.
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
Page 75 of 1168