nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,819 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects a single identity/IP querying Microsoft Graph endpoints for directory roles, role management, registered authentication methods, applications, service principals, OAuth2 permission grants, and app role assignments within a short window - control-plane reconnaissance mapping privilege escalation and persistence opportunities
Detects registration of a new actor-controlled MFA authentication method (phone, authenticator app, or software OTP token) via an Update user operation, matching the NO_DEVICE/NO_DEVICE_TOKEN/SoftwareTokenActivated pattern used to convert temporary compromise into durable identity persistence
Detects an anomalous OfficeHome sign-in from an unmanaged device that completes secondary auth (error 50074) followed by a keep-me-signed-in event (error 50140), with the same session/user then rapidly accessing multiple sensitive applications (My Apps, My Profile, Account Controls, My SignIns, SharePoint/OneDrive/Outlook) - consistent with AiTM-assisted MFA bypass and persistent session establishment
Device code authentication flow completed, followed by subsequent session activity from a different IP/user-agent, indicating token replay to an attacker-controlled client that bypasses MFA
Detects the execution of PowerShell commands initiated directly from explorer.exe that contain indicators of the 'ClickFix' attack vector, specifically commands designed to extract data from the clipboard (e.g., Get-Clipboard) or download/execute remote content (e.g., iwr, iex). This activity typically occurs when a user is socially engineered into copying and pasting malicious instructions into the Windows Run dialog.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects network requests to Microsoft Graph API that appear to be modifying authentication methods, specifically targeting phone-based multi-factor authentication settings. This may indicate an adversary attempting to register their own MFA device to a compromised account to maintain persistence or bypass MFA.
Detects ClickFix attack patterns where users are coerced into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The command uses clipboard access (Get-Clipboard) or network download/execution (iwr, iex) methods, commonly associated with the Potemkin Loader or RMM-based distribution campaigns.
Detects a suspicious pattern where a user successfully authenticates via MFA, followed by another successful sign-in attempt for the same account within 10 minutes using a different IP address or user agent. This behavior is often indicative of session hijacking or adversary-in-the-middle (AiTM) attacks where a session token is stolen and replayed from an attacker-controlled environment.
Detects ClickFix-style attacks where users are social-engineered into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The rule specifically monitors for powershell.exe being initiated by explorer.exe with command-line arguments involving clipboard access (Get-Clipboard) or web-based script retrieval/execution (iwr, iex).
Page 1 of 70