Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
Detects high volumes of authentication failures within Okta, characterized by a single source IP address targeting a large number of distinct user accounts. This behavior is indicative of automated credential attacks, such as password spraying or credential stuffing, designed to discover valid credentials or exploit reused passwords while attempting to evade account lockout thresholds.
Entra ID Device Registration Event
Cortex XDR
Detects device registration events within Entra ID. Attackers may register their own device to a compromised account to maintain persistent access or satisfy device-compliance conditional access policies.
Detects outbound network connections to identified infrastructure associated with 'Pink' (CL-CRI-1147) passkey-enrollment vishing campaigns. These operators use phone-based social engineering to direct victims to phishing domains that relay credentials and MFA tokens in real-time to register attacker-controlled passkeys. The rule monitors for specific DNS query patterns containing passkey-related keywords and known malicious IP addresses used by the threat group.
Detects a near-simultaneous correlation between a user registering a new FIDO2 authentication method and a login session from an unmanaged or non-compliant device. This behavioral pattern is often associated with adversary-in-the-middle or vishing attacks where an attacker tricks a user into registering an attacker-controlled security key to maintain persistent MFA access.
Detects the modification of an existing IAM role's trust policy to include new trusted principals (external AWS accounts, root principals, or wildcards). This technique is used for persistence and privilege escalation by modifying existing roles to allow access by an attacker-controlled principal, effectively bypassing detections focused on the creation of new roles.
Detects anomalous NTLM authentication activity (LogonType 3) where a single account or source IP attempts to authenticate to 25 or more unique hosts within a 10-minute window. This behavioral pattern is frequently observed during credential spraying, pass-the-hash attacks, or unauthorized lateral movement attempts using NTLM.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. UNC6692 ("Snow Flurries") impersonates IT helpdesk over Teams, lures victims to a fake "Mailbox Repair Utility" page, and delivers a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects potentially unauthorized data exfiltration or bulk extraction activities within Google Cloud BigQuery. The rule monitors for large-scale data queries (SELECT * or queries without filters), data exports to external Google Cloud Storage buckets, and queries executed by automated scripts or tools, which are common indicators of staged data theft following cloud environment compromise.
Detects modifications to Google Cloud IAM policies where permissions are granted that allow service account impersonation or key management (e.g., serviceAccountTokenCreator, serviceAccountKeyAdmin, workloadIdentityUser, serviceAccountUser). These roles are frequently abused by attackers to gain durable, persistent access or escalate privileges by generating tokens as highly-privileged service accounts without requiring an existing service account key.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Page 12 of 25