Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,667 detections
Filters
Last updated
All Time
Detection languages
1,078
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,456
11,839
5,876
5,155
4,865
1,667
Platforms
1,092
591
440
252
122
Products / Services
1,131
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects anomalous, high-velocity authentication activity where a single identity accesses multiple high-value SaaS applications (such as CRM, DevOps, or admin consoles) in a short time frame, correlated with risk signals indicative of token reuse or 'pass-the-cookie' attacks.
Detects anomalous authentication patterns where a user account accesses a large number of distinct SaaS/SSO resources within a short time frame from devices or IP addresses not previously associated with the user's historical baseline. This behavior is indicative of a stolen session cookie being replayed by an adversary to perform rapid lateral movement across the victim's cloud footprint.
Detects non-interactive sign-in events in Entra ID that occur without a preceding interactive sign-in session on the same device that successfully satisfied a multi-factor authentication (MFA) challenge. This behavior is indicative of token replay attacks or session hijacking where an adversary attempts to use harvested session cookies or tokens to access resources.
Detects anomalous Entra ID sign-in patterns indicating potential session hijacking or stolen session cookie replay. The rule identifies pairs of successful sign-ins where the geographic distance and time elapsed suggest impossible travel, or where the device/browser context changes without a fresh MFA challenge, suggesting the bypass of authentication requirements via persistent session tokens.
Detects successful authentication attempts using legacy protocols or non-interactive refresh tokens for user accounts previously flagged within a 14-day window as being involved in infostealer or credential exposure events.
This rule detects potential session hijacking by monitoring for the reuse of session or refresh tokens from unrecognized devices, browsers, or user agents, particularly when such activity occurs without an interactive MFA challenge. This behavior is indicative of an attacker attempting to use stolen session cookies or tokens to access cloud resources.
Detects anomalous authentication patterns where multiple distinct user identities authenticate from the same source IP (often a VPN or proxy) within a short timeframe, characteristic of North Korean IT worker laptop-farm or identity-mule operations where a single operator manages multiple contractor accounts.
Detects user account sign-in attempts originating from a country not observed in the previous 30 days, or from an ISP flagged as a VPN, proxy, or hosting/cloud provider. This behavior is consistent with an adversary utilizing stolen credentials or session tokens through anonymity infrastructure to bypass conditional access policies.
Detects the reuse of session tokens from distinct network locations, devices, or user agents shortly after a successful MFA-protected login. This behavioral pattern is a primary indicator of Adversary-in-the-Middle (AiTM) phishing, where attackers capture session tokens via reverse proxy to bypass authentication controls.
This rule detects potentially malicious Microsoft 365 sign-in events characterized by the use of residential proxy network providers commonly associated with session hijacking activities. It specifically flags sessions that were allowed without a Multi-Factor Authentication (MFA) challenge, suggesting the use of an already authenticated stolen session token.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity where a user successfully authenticates to Microsoft 365 with MFA, followed shortly by a session from a different IP address reusing the same session ID without a repeated MFA challenge.
Detects instances where a user account triggers a risky sign-in event (flagged by identity protection) and subsequently uses the same session or token to authenticate successfully from a different network location or IP address within two hours. This behavior suggests that a malicious actor may be leveraging a compromised session token that should have been revoked, potentially indicating a failure of continuous access evaluation or token revocation mechanisms.
Detects potential Adversary-in-the-Middle (AiTM) activity by identifying successful multi-factor authenticated sign-in events from the same user across different geographic regions and IP addresses within a one-hour timeframe, which is characteristic of session cookie replay attacks.
Detects potential Golden SAML activity by correlating Azure AD SAML sign-in events for privileged accounts with a lack of corresponding server-side ADFS authentication logs, unusual SAML issuer URIs, lack of on-premises authentication logs, or evidence of direct access to ADFS token-signing certificate private key material.
Detects repeated, silent authentication events in Microsoft 365 where MFA challenges are absent, consistent with the use of stolen session or refresh tokens (e.g., EvilTokens) to maintain persistent, unauthorized access to user accounts.
This rule detects potential Kerberoasting activity by monitoring Kerberos TGS requests (Event ID 4769) that use RC4 encryption (0x17 or 17). It identifies accounts requesting TGS tickets for a large number of unique Service Principal Names (SPNs), excluding requests for host-based services (ending in $). High volumes of such requests from a single user are indicative of an attempt to gather service tickets for offline password cracking.
Detects instances where a user grants consent to an unverified OAuth application with high-privilege scopes (e.g., Mail.Read, Directory.Read.All), followed by an authentication event using that same application ID from a different IP address within 24 hours. This behavior is indicative of potential consent phishing or OAuth token abuse, where an adversary harvests tokens to maintain persistent, remote access to email or directory services.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects anomalous device-authorization-grant (RFC 8628) activity indicative of device-code phishing attacks (e.g., Tycoon2FA). The rule identifies user accounts exhibiting a rapid succession of 'authorization_pending' (70016) status polling attempts followed by a successful token issuance (0), constrained to a short time window and excluding known first-party Microsoft CLI/dev-tool applications.
Page 16 of 80