Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Targets high-volume account failures followed by a successful tunnel or portal authentication. The UDM rule retains principal and target context for correlation.
Detects an SSPR (Self-Service Password Reset) event immediately followed by the registration of a new Microsoft Authenticator method for the same user. This sequence of events can indicate an attacker has compromised an identity, performed a password reset, and is attempting to establish a new MFA method for persistent access.
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects device registration attempts mapping a refresh token to the Device Registration Service (ms-drs) for persistence. This activity can be indicative of an adversary attempting to maintain access or bypass conditional access policies by registering a new device.
Identifies device registration events where the user agent indicates script or automated frameworks (like axios, node, undici, node-fetch) rather than native registration clients. This behavior is associated with adversaries like Tycoon 2FA, which establishes device-bound persistence (PRT) that survives standard session revocation, making this a critical post-compromise detection.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
Identifies login_verification events completing in less than 1 second, strongly indicative of automated AiTM proxying.
Detects Microsoft Authentication Broker (MAB) accessing enterprise applications outside of the expected first-party subset. This could indicate an attempt to bypass multi-factor authentication (MFA) or gain unauthorized access to resources.
Detects Google Workspace OAuth authorizations requesting the Chrome native client ID, which has been observed to be used by threat actors like Tycoon 2FA to mint tokens for illicit access.
Detects sign-ins to Entra ID using Axios, Undici, or Node-Fetch user agents, which are fingerprints of Tycoon 2FA attacks. This rule helps identify potential multi-factor authentication bypass attempts.
Detects device code authentication via Microsoft Authentication Broker targeting Microsoft Graph, which is a known indicator of Adversary-in-the-Middle (AiTM) attacks or device code phishing.
Identifies login attempts from RedVDS infrastructure IPs deliberately utilizing legacy authentication protocols (IMAP/POP3) to bypass Modern Authentication Conditional Access policies.
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects potential MFA bypass attempts by identifying multiple successful sign-ins from the same user within an hour where Conditional Access policies were not applied, and no MFA method was used. This could indicate an adversary circumventing security controls to gain unauthorized access.
Detects a user interrupt error (50199) followed by a successful authentication within 5 minutes, a pattern observed in device code phishing attacks. This rule specifically looks for sign-in logs where both error code 0 (success) and 50199 (user interrupt) occur for the same user and correlation ID within a 5-minute window.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
This rule detects repeated failed or successful logon attempts (EventID 4625 or 4624) to sensitive system accounts like 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', or 'ADMIN$' from non-system accounts. It specifically looks for interactive (LogonType 10), remote interactive (LogonType 3), or unlock (LogonType 9) logons, and triggers if there are 3 or more such attempts within an hour for the same account and computer.
Detects forged Golden SAML tokens used for identity federation bypass
Detects sign-ins to M365 using the default Node.js user agent, indicative of the Tycoon 2FA kit relay tier.
Detects brute force or credential stuffing against social media accounts
This rule detects an unusual pattern of multiple login attempts from several unique devices using Windows Hello for Business within a short timeframe (5 minutes) for a single user. This could indicate an MFA bypass attempt or a compromised account where an adversary is attempting to gain access from various devices.
Page 27 of 51