Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects execution of the macOS 'dscl' utility using the '-authonly' flag. This command is used to authenticate a user against a directory service without creating a session, which can be indicative of brute-force attempts or credential validation by unauthorized processes.
Detects the use of spoofed Exchange Online Application IDs in Azure sign-in logs. Attackers use these specific spoofed AppID patterns to bypass controls during Resource Owner Password Credential (ROPC) authentication, often for user enumeration purposes.
This rule detects authentication attempts in Azure AD Sign-in Logs where the User Agent identifies the request as originating from the Python Requests library (version 2.32.3). This pattern is often indicative of Resource Owner Password Credentials (ROPC) flows, which are frequently abused by threat actors to perform credential stuffing or automated authentication bypassing multi-factor authentication (MFA) requirements in cloud environments.
Detects sign-in attempts where the OAuth Client ID (AppId) does not have a corresponding display name (AppDisplayName) in the logs, and the same Client ID is observed across multiple different Azure tenants. This pattern often indicates an adversary using a malicious or spoofed OAuth application to perform multi-tenant abuse, consent phishing, or unauthorized access across different organizational boundaries.
Detects anomalous authentication patterns originating from a single IP address where multiple users are targeted. The rule specifically monitors for a combination of error codes (50034 - User not found, 50126 - Invalid credentials, 700016 - Multi-factor authentication required) to identify potential password spraying or brute force activity targeting Microsoft Entra ID (formerly Azure AD).
Detects Microsoft Entra ID sign-in events where the AppId (OAuth client_id) is a
syntactically valid UUIDv4 but no corresponding AppDisplayName is populated,
indicating the client ID does not correspond to any registered enterprise
application in the tenant. This pattern is consistent with randomly generated,
valid-format spoofed client IDs used in ROPC-based username/password
enumeration.
syntactically valid UUIDv4 but no corresponding AppDisplayName is populated,
indicating the client ID does not correspond to any registered enterprise
application in the tenant. This pattern is consistent with randomly generated,
valid-format spoofed client IDs used in ROPC-based username/password
enumeration.
Detects Microsoft Entra authentication events using the Resource Owner Password Credentials (ROPC) grant type where the User-Agent string explicitly identifies as a Microsoft Outlook desktop client. Adversaries often spoof these User-Agent strings in OAuth client ID campaigns to bypass conditional access policies or appear as legitimate traffic during automated login attempts.
Detects short-window spikes in Entra sign-in/token-request event volume (exceeding roughly 100,000-250,000 events within a single day per tenant), consistent with automated client-ID-spoofed ROPC enumeration campaigns that exhibit a multi-day burst-then-quiet cadence.
Detects a high-volume burst of ROPC (Resource Owner Password Credentials) sign-in attempts using a spoofed/unregistered OAuth client ID, identified by a populated Application ID field paired with a blank Application Name field, targeting a single account within a short window. This enumeration pattern has been observed to correlate with mass account lockouts across an organization.
Detects sign-in activity in Entra ID where the application display name is blank, despite an Application ID being present, originating from known cloud service provider IP ranges (AWS or Cloudflare). This pattern is consistent with automated enumeration or discovery tools that leverage OAuth client ID spoofing or misconfigurations to identify valid tenants or users.
This rule detects the use of the OAuth 2.0 Device Code Authorization flow directed towards 'microsoft.com/devicelogin'. This authentication method is frequently abused by attackers in phishing campaigns to hijack device-based user sessions by tricking victims into entering a device code on a malicious site, effectively bypassing traditional password-based authentication.
Detects the presence of specific Microsoft Entra (formerly Azure AD) authentication session cookies (ESTSAUTH, ESTSAUTHPERSISTENT, ESTSAUTHLIGHT) in web proxy traffic. This activity is indicative of session cookie theft and potential replay attacks (Pass-the-Cookie) where an adversary attempts to authenticate to Microsoft services using stolen session material from an unauthorized or non-enrolled device.
KQL Query from file: The Hunt for QR Phisher
Detects non-interactive sign-ins to Azure CLI using the 'python-requests' User-Agent by non-administrative users. This pattern is associated with the LSHIY password spray campaign, which exploits the OAuth ROPC flow for credential abuse against Microsoft 365.
This rule detects potential brute force authentication attempts via LDAP occurring shortly after a specific DLL (ending in 'ode.dll') is loaded on a system. This behavior may indicate an adversary is using a malicious or secondary module to facilitate credential brute forcing or unauthorized authentication attempts.
Detects non-interactive sign-ins to Microsoft 365 using the OAuth Resource Owner Password Credentials (ROPC) flow via the Azure CLI. This legacy authentication method enables attackers to bypass multi-factor authentication (MFA) by submitting credentials directly to the authentication endpoint, a technique observed in password spraying campaigns.
Detects high-volume or multi-account failed LDAP simple-bind authentication attempts against the Active Directory Global Catalog port (3268). This behavior is consistent with automated password spraying or brute-force tools, such as the Cavern Manticore LdapBrute module, which attempt to validate credentials across multiple accounts.
This use case detects a potential bypass of a conditional access policy. Most likely bypass would be your MFA policy, bypassing multi factor authentication via some sort of vulnerability or misconfiguration.
This rule detects the creation of unauthorized technician accounts in the SimpleHelp RMM platform that follow an OIDC authentication bypass pattern (CVE-2026-48558). It correlates server logs indicating 'New Anon' registration activity with Windows Security Event ID 4720 (User account created), specifically filtering for accounts that do not belong to trusted corporate domains.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Page 19 of 51