Akhil Sable
@kayshikaCompletionist
0 followers0 downloads15 copies0 likes33 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
2
1
1
1
1
Platforms
1
1
1
1
Products / Services
1
1
1
1
MITRE Techniques
2
2
1
1
1
CVEs
1
Detects potential NTLM credential leaks where Outlook processes (.msg file handling or execution) are followed closely by outbound network connections on ports 445 (SMB) or 80 (HTTP/WebDAV) to external IP addresses.
Detects a password spray attack pattern (characterized by multiple failed authentication attempts across numerous distinct accounts from a single source IP or known Storm-0940 IPs) followed by successful sign-ins and subsequent credential additions or role assignments to OAuth applications or service principals within a 6-hour window.