Daniel Koifman
@KoifsecTrusted contributorCompletionist
4 followers237 downloads217 copies5 likes48,125 views
51 detections
Filters
Last updated
All Time
Detection languages
17
16
9
6
3
Categories
20
6
3
3
2
Platforms
34
1
1
Products / Services
16
3
MITRE Techniques
7
5
5
4
4
The rule detects execution of BloodHound or its ingestors by matching on process creation events where the new process name is bloodhound.exe or the command line contains characteristic BloodHound arguments.
No description available.
A service principal authenticating from an IP address it has never used in the past 14 days - the strongest signal of credential theft for NHIs, equivalent to “impossible travel” for human identities.
Unusual File Download
YARA-L
The rule detects successful HTTP downloads (response code 200 or 206) of potentially dangerous file types - including executables, scripts, disk images, shortcuts, and macro-enabled Office documents.
High-privilege permission grants (Mail, Files, Directory, Role Management) and sensitive role assignments. The full_access_as_app and Exchange.ManageAsApp permissions are especially critical — these grant tenant-wide mailbox access without user delegation, exactly the capability Midnight Blizzard exploited.
This rule detects the default Rclone user agent activity.
This rule detects HTTP user-agent strings that appear on multiple distinct source hosts over a time period with multiple total requests, after excluding empty/null user-agents and known bot/monitoring strings (Googlebot, bingbot, Slackbot, monitoring).
This rule alerts when a URL to create a token for an Entra ID user via Visual Studio is detected.
Any credential addition to an application registration or service principal, distinguishing whether the actor was a human user or another service principal. When InitiatedByType == "ServicePrincipal", the alert severity should be critical - service principals adding credentials to other service principals is the hallmark of automated persistence.
One service principal modifying another service principal’s configuration - credential additions, owner changes, permission grants. This is the cross-application pivot pattern. In a healthy environment, this should be extremely rare.
Page 3 of 6