Aamir Muhammad
@AamirTrusted contributorCompletionist
4 followers59 downloads1,103 copies30 likes30,775 views
52 detections
Filters
Last updated
All Time
Detection languages
27
25
Categories
22
21
19
17
16
Platforms
42
7
3
3
3
Products / Services
16
10
6
5
5
MITRE Techniques
30
26
25
22
11
CVEs
1
1
1
This rule detects the presence and activity of PAM-based backdoors on Linux systems by looking for specific SHA256 hashes and filenames associated with known PAM backdoors. It monitors process events, general device events, file events, and image load events on Linux devices.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration).
The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
Page 6 of 6