Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
Suspicious Azure VM Extension Deployment
Cortex XDR
This rule detects the deployment of suspicious or potentially malicious extensions on Azure Virtual Machines. These extensions, such as CustomScriptExtension, RunCommandHandler, DSCExtension, AADLoginForWindows, and NetworkWatcherAgent, can be abused by adversaries for various purposes including remote code execution, account manipulation, and network reconnaissance. Monitoring their deployment can help identify unauthorized activity within an Azure environment.
Box SaaS Suspicious File Download
Cortex XDR
Detects file downloads from Box which could indicate potential data exfiltration by insiders or compromised accounts. This rule specifically looks for 'DOWNLOAD' operations within Box SaaS audit logs.
Kali365 PHaaS Device Code Detection
Cortex XDR
This rule detects potential device code phishing attempts by correlating a device code flow initiated from an unmanaged/non-compliant device with a suspicious user agent (e.g., 'python-requests' or '-live') and an 'unbound' signInTokenProtectionStatus, with a subsequent 'Cmsi:Cmsi' token replay event for the same user. This combination suggests a successful device code phishing attack where an adversary has obtained and is replaying a token after the victim has authenticated.
This rule detects authentication attempts to Microsoft 365 Azure AD from a list of known malicious IP addresses and CIDR ranges associated with the EvilToken phishing campaign. It specifically filters for 'Cmsi:Cmsi' request types, which are indicative of session replay signals used in device code phishing.
Detects suspicious sharing activity in Box, including the creation of open links, external collaboration invites, role escalation, and weakening of sharing policies. This rule identifies high-risk activities such as making files publicly visible without password protection, inviting external users with co-owner or editor roles, and changes that reduce security like removing expiration dates on shared links.
This rule detects DNS queries to known malicious domains associated with the Tycoon2FA phishing campaign. These domains are used for anti-bot verification during the attack chain, which typically involves hijacking Microsoft 365 accounts via device code phishing.
Azure VM RunCommand Activity
Cortex XDR
This rule detects activity related to Azure VM RunCommand, which allows execution of scripts on virtual machines without requiring RDP/SSH access. It specifically looks for 'WRITE', 'ACTION', 'DELETE', and 'READ' operations, filtering for successful or accepted statuses and valid identities. This activity can indicate an attacker executing commands or performing post-execution cleanup.
Tycoon2FA Known Infrastructure Detection
Cortex XDR
This rule detects suspicious sign-in attempts to Microsoft 365 accounts that originate from known Tycoon2FA infrastructure. It specifically looks for device code flow authentications from IP addresses and Autonomous System Numbers (ASNs) associated with Tycoon2FA, combined with indicators like unmanaged/non-compliant devices, specific user agent patterns (axios, node, undici), and particular application IDs, and an unbound sign-in token protection status. This combination of indicators suggests an attempt to hijack Microsoft 365 accounts using device code phishing.
Tycoon2FA PHaaS User Agent Detection
Cortex XDR
Detects user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) campaigns, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies user agents like 'axios/1.13.x' (credential relay variant) and 'node' or 'undici' (device code variant) in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
Page 17 of 25