Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
This rule detects suspicious Microsoft Graph API activity involving the enumeration of user accounts within an organization. It specifically monitors for queries targeting personnel in sensitive roles such as payroll, finance, HR, and administration, as well as bulk enumeration attempts. The detection logic also flags usage of the axios HTTP library, a common tool in such reconnaissance campaigns, and aggregates results by source IP/ASN to identify coordinated efforts, such as those associated with the Storm-2755 threat actor.
This rule detects Azure AD sign-in attempts to the 'OfficeHome' application resulting in error code 90014. This specific error indicates that the OAuth flow was initiated without the required nonce parameter, a behavior frequently observed when adversary-in-the-middle (AiTM) phishing kits relay authentication flows incorrectly. The rule highlights the significance of this error when correlated with implausible user-agent and operating system combinations.
Detects OAuth application authorization events where the granted scopes include highly sensitive access such as Gmail, Drive, or Admin APIs. This rule identifies potential consent phishing attacks where users are tricked into granting malicious third-party applications broad, unauthorized access to their Google Workspace account. The rule excludes common, expected applications like Google Cloud SDK or standard Google services.
Detects mass revocation of OAuth tokens by a user, which may indicate an attacker cleaning up evidence after data extraction, or legitimate administrative incident response activity.
This rule detects instances where a process that is not a recognized web browser attempts to access sensitive files associated with browser credential stores, such as Login Data, Cookies, and web browser state files. Such activity is commonly associated with infostealer malware, which attempts to exfiltrate saved passwords, session cookies, and autofill information.
Detects user account lockouts or instances where a user has been flagged for frequent failed authentication attempts within the Duo Security platform. This activity is indicative of brute force attacks, credential stuffing, or attempts to bypass Multi-Factor Authentication (MFA) via fatigue or repeated request generation.
Detects unauthorized modifications to Windows Registry keys responsible for forcing browser extensions. Attackers often abuse 'ExtensionInstallForcelist' and related policy keys in Google Chrome, Microsoft Edge, or Brave to silently install malicious extensions for persistence or credential theft. This rule flags modifications performed by processes other than known system administration or GPO management tools.
Detects MFA authentication attempts in Duo where the source IP address is identified by Duo as a known anonymous proxy, VPN, or Tor exit node. Such infrastructure is frequently used by adversaries to mask their true origin during credential stuffing, session hijacking, or post-compromise activity.
Detects anomalous OAuth application authorization behavior by a user, specifically monitoring for a spike in authorization events within a short timeframe. This activity is often indicative of consent phishing campaigns where an adversary tricks a user into granting excessive application permissions to a malicious OAuth app, or a compromised account performing bulk authorization grants.
Detects the use of sts:AssumeRoot within an AWS Organization. This action allows an entity within the management account to assume root-level access in a member account, effectively bypassing standard IAM restrictions. This is a high-risk event indicative of potential privilege escalation or management account compromise.
Page 10 of 25