Tag
Detection of Anomalous MFA Device Provisioning Following Credential Reset
2 TTPsThis detection brief identifies potential account takeover attempts by monitoring for the provisioning of a new MFA device within one hour of a Windows password reset event.
Detection of ConvertTo-AADIntBackdoor PowerShell Cmdlet Execution
1 rule 2 TTPsThe execution of the ConvertTo-AADIntBackdoor PowerShell cmdlet indicates an attempt to compromise Azure AD federation settings to enable unauthorized token generation and persistent access.
Okta AiTM Session Cookie Replay Attacks
2 TTPsAdversary-in-the-Middle (AiTM) phishing attacks leverage reverse proxies to capture and replay authenticated Okta session cookies, bypassing multi-factor authentication (MFA) protections.
Detection of Google Workspace Suspicious Login Events
1 rule 1 TTPGoogle Workspace audit logs identify suspicious authentication attempts including unauthorized application access, programmatic login anomalies, and general suspicious sign-in events.
Multiple Vulnerabilities in Microsoft Azure, Entra, and Azure CLI
3 TTPsMultiple vulnerabilities across Microsoft Azure, Entra, and Azure CLI allow for identity impersonation, unauthorized data access, privilege escalation to SYSTEM level, and arbitrary code execution.
Detection of Active Directory Account Management via PowerShell
1 rule 1 TTPAdversaries may use the System.DirectoryServices.AccountManagement namespace in PowerShell to programmatically create or manipulate domain accounts for persistence within Active Directory environments.
Authentication Bypass in pac4j-oidc via Token Forgery
1 TTP 1 CVEAn authorization bypass vulnerability in pac4j-oidc versions prior to 6.5.6 allows attackers to forge OIDC access tokens by exploiting the library's failure to validate token signatures, issuers, audiences, and expiration.