Tag
Google Workspace Device Registration Burst for Single User
1 rule 3 TTPsDetects bursts of Google Workspace device registration events for a single user exceeding three distinct device registrations within one minute, indicative of AiTM phishing or stolen OAuth token replay attacks.
Entra ID Kali365 User-Agent Detected
2 rules 4 TTPs 4 IOCsThis brief detects the use of the Kali365 user agent, a phishing-as-a-service platform, within Entra ID or Microsoft 365 logs, indicating potential account compromise through stolen tokens.
Tycoon2FA AiTM Phishing via Microsoft Entra ID Sign-Ins
2 rules 2 TTPsDetects Microsoft Entra ID sign-ins consistent with Tycoon2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity targeting Microsoft 365 and Gmail, where the Microsoft Authentication Broker requests tokens for Microsoft Graph or Exchange Online, or the Office web client application authenticates to itself, combined with Node.js-style user agents (node, axios, undici).
Entra ID Excessive Account Lockouts Detected
2 rules 3 TTPsA high volume of failed Microsoft Entra ID sign-in attempts resulting in account lockouts indicates potential brute-force attacks, such as password spraying or credential stuffing, targeting user accounts.
PowerShell Kerberos Ticket Request via KerberosRequestorSecurityToken
2 rules 1 TTPThis rule detects PowerShell scripts that request Kerberos service tickets using KerberosRequestorSecurityToken, potentially indicating Kerberoasting attacks for offline password cracking of service accounts.
Suspicious AWS EC2 Key Pair Creation from Non-Cloud AS
2 rules 3 TTPsAn AWS EC2 CreateKeyPair event triggered by a new principal originating from a network autonomous system (AS) organization not associated with major cloud providers, indicating potential unauthorized access or persistence activity.
Potential Kerberos Relay Attack via Coerced Authentication against a Computer Account
3 rules 1 TTP 1 CVEDetects potential Kerberos relay attacks by identifying coercion attempts followed by authentication events using a target server's computer account, originating from a different host, indicating an attacker has captured and relayed Kerberos authentication material to execute code on behalf of the compromised system.
Kubernetes Pod Exec Cloud Instance Metadata Access
2 rules 2 TTPsDetection of Kubernetes pod exec sessions accessing cloud instance metadata endpoints, indicating potential credential theft from AWS, GCP, or Azure.
LSASS Memory Dump Creation Detection
2 rules 1 TTPThis rule identifies the creation of LSASS memory dump files, often indicative of credential access attempts using tools like Task Manager, SQLDumper, Dumpert, or AndrewSpecial, by monitoring for specific filenames and excluding legitimate dump locations.