Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
eDiscovery or Compliance Search Created
Cortex XDR
Detects creation and execution of compliance searches or eDiscovery cases in Exchange/SaaS environments. Attackers with administrative access may use compliance searches to harvest sensitive data such as credentials, financial records, or PII across the organization.
Detects PowerShell attempting to install and start the OpenSSH Server on Windows, typically triggered by malicious extensions or backdoors to enable remote SSH access.
GCP Vertex AI Model or Endpoint Deletion
Cortex XDR
Detects deletion or un-deployment of GCP Vertex AI models, endpoints, custom jobs, or deployment resources. Attackers may destroy fine-tuned intellectual property, disrupt AI services, or delete resources to cover their tracks.
Box Shield Suspicious Location Access
Cortex XDR
Surfaces Box Shield suspicious location alerts with geographic context and accessed content details. Detects access from unusual or excluded geographic locations indicating potential compromised accounts or credential theft.
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Box Shield Anomalous Download
Cortex XDR
Surfaces Box Shield anomalous download alerts with full context extraction, including download delta, historical baseline vs anomaly period comparison, and source IPs.
Detects high-volume Microsoft Graph API activity using attacker-associated user agents, such as python-requests, curl, or httpx, which may indicate automated token sweeping or data collection associated with supply-chain attacks.
Box Shield Malicious Content Upload
Cortex XDR
Surfaces Box Shield malware detection alerts with file hash, upload path, source IP, and scan results for immediate correlation and threat response.
Detects Azure AD service principal sign-ins utilizing suspicious scripting-related user agents such as curl, python-requests, Wget, or Postman, which may indicate automated scripting, custom tooling, or potential abuse of cloud service accounts.
Detects new client secrets or certificates added to any service principal in Azure AD, specifically identifying activities linked to the ConnectWise supply-chain attack or suspicious user agents.
Page 2 of 25