Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,667 detections
Filters
Last updated
All Time
Detection languages
1,078
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,456
11,839
5,876
5,155
4,865
1,667
Platforms
1,092
591
440
252
122
Products / Services
1,131
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects a successful authentication to Microsoft SQL Server using the 'sa' account from a non-local address. This rule is designed to alert on potentially unauthorized access following a brute-force attack, as identified by the correlation of high-volume authentication failures (Event ID 18456) followed by a successful login (Event ID 18453/18454).
Detects a potential TeamFiltration-style compromise where multiple accounts with no history of successful authentication and no MFA enforced authenticate successfully within a 7-minute burst window. This behavior is indicative of an adversary mass-testing or accessing newly compromised dormant or un-secured service accounts.
Identify cases where privileged tokens appear in unexpected contexts (e.g., admin accounts logging into low-tier devices, unusual logon types, or rare hosts).
Detects sign-in events where an external authentication provider is used to fulfill a multi-factor authentication requirement while simultaneously asserting a 'hardware-key' (hwk) claim. This behavior is indicative of an adversary abusing a rogue or misconfigured external MFA provider to forge authentication claims and bypass security controls.
Detects successful VPN logins that bypass multi-factor authentication (MFA) and originate from unusual ASN/IP addresses or occur during atypical hours. This behavior is indicative of potential unauthorized access using compromised credentials, consistent with threat actor patterns that exploit environments lacking mandatory MFA enforcement.
Detects successful sign-in events where Multi-Factor Authentication (MFA) was satisfied using an 'External Authentication Method' that reports specific claim identifiers ('possessionorinherence' or 'hwk'). This pattern is indicative of the TrustSink rogue-EAM (External Authentication Method) technique, where an attacker exploits custom MFA providers to forge MFA success assertions, effectively bypassing legitimate hardware-key requirements.
Detects potential theft and reuse of session or refresh tokens for Microsoft 365 services (Exchange/SharePoint) by identifying multiple authentication events for the same user account from different geographic locations and IP addresses within a short timeframe, specifically when no new MFA challenge was performed.
Detects potential abuse of the Microsoft Graph API by correlating device-code authentication events with subsequent high-volume activity, such as mail or file enumeration, from the same account within a short window. This pattern is indicative of ARToken-style token proxying, where an attacker intercepts an OAuth device-code token to gain unauthorized access to an user's resources.
Detects potential persistence establishment in M365 environments following anomalous or risky sign-in events. This pattern is characteristic of Adversary-in-the-Middle (AiTM) attacks where a session cookie is stolen, followed by immediate adversary actions to secure long-term access, such as MFA method registration, OAuth app consent, or mailbox rule configuration.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects successful OAuth 2.0 device authorization grant sign-ins using the 'Microsoft Authentication Broker' client. This pattern is commonly used in device-code phishing (GhostCode) to trick users into authorizing a malicious application, often bypassing multi-factor authentication (MFA) requirements.
This rule monitors for potential privilege escalation activity occurring shortly after an initial authentication event. It includes two primary vectors: 1) Azure AD users assigned to highly privileged roles shortly after a successful sign-in; 2) Users performing interactive or remote logons to Linux/Unix systems followed quickly by sudo or su commands to obtain root privileges.
Detects Azure AD/Entra ID sign-ins performed using the OAuth device-code flow, excluding common administrative tools like the Azure CLI or PowerShell. This flow is frequently abused in phishing campaigns (such as EvilTokens or ARToken) where attackers entice victims to enter a device code into a malicious application, allowing the attacker to gain authorized access to the victim's session.
Detects instances where a user experiences an interrupted sign-in event (Azure AD error code 50199) followed closely by a successful sign-in from the same user account. This pattern is often indicative of Adversary-in-the-Middle (AiTM) phishing, where an attacker intercepts an authentication request, prompts the user, and replays the captured session material.
Detects anomalous, automated non-interactive sign-in activity in Microsoft 365 where a session token is replayed from a new source IP address approximately every 8 hours. This pattern is characteristic of automated token-refresh tooling, such as that associated with Storm-2755, utilizing specific user-agents (Firefox 131.0/151.0 or python-requests) that deviate from the user's typical browser fingerprint.
This rule detects non-interactive sign-in events to common Microsoft services (e.g., OfficeHome, Outlook) where the User-Agent string contains 'axios/1.7.9'. This pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing kits that use the Axios library to automate token replay attacks by simulating browser sign-in requests.
Detects Microsoft 365 sign-in activity consistent with adversary-in-the-middle (AiTM) token theft. The rule identifies successful sign-ins with multi-factor authentication, immediately followed by a new session attempt for the same user within 30 minutes from a different device, IP address, or location.
Detects Microsoft Entra OAuth 2.0 device authorization grant flow completion immediately followed by non-interactive API access from automated user agents like python-requests. This behavior is indicative of device code phishing kits, where an attacker tricks a user into entering a code and then programmatically hijacks the resulting session token.
Detects sign-in events using the OAuth 2.0 device code flow, which is a mechanism often abused in phishing campaigns (such as GhostCode) to lure users into authorizing malicious applications or granting access tokens without needing their actual credentials.
Detects suspicious non-interactive Entra ID sign-in events using the 'python-requests' User-Agent against sensitive Microsoft resources such as Microsoft Graph, Device Registration, or Intune. This activity is indicative of automated token abuse, particularly in the context of device-code phishing kits (e.g., GhostCode), where an attacker uses stolen session information to interact with Microsoft APIs.
Detects potential device code phishing patterns where a successful OAuth device-code authentication is rapidly followed by Microsoft Graph resource access from the same account. The rule identifies suspicious polling sessions (e.g., EvilTokens) by monitoring for successful device-code sign-ins and immediate, subsequent Graph API activity. It filters known first-party applications and incorporates risk-based triggers and reconnaissance behavioral patterns to minimize false positives.
Page 20 of 80