Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,667 detections
Filters
Last updated
All Time
Detection languages
1,078
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,456
11,839
5,876
5,155
4,865
1,667
Platforms
1,092
591
440
252
122
Products / Services
1,131
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
This rule detects a correlation between a successful user login from an IP address not previously seen for that specific user in the last 14 days, followed immediately (within 1 hour) by sensitive administrative operations performed by the same user, such as adding members to roles or modifying application permissions.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects instances where a single Kerberos logon session (TargetLogonId) is utilized to authenticate from multiple distinct source hosts or IP addresses within a one-hour window. This behavior is inconsistent with normal Kerberos authentication patterns and is a strong indicator of Pass-the-Ticket (PtT) activity, commonly associated with tools like Mimikatz or Rubeus where a stolen ticket is injected into multiple sessions or systems.
Detects Microsoft Entra ID service principal (app-only) sign-in events where an application accesses a resource or tenant that has not been observed in the previous 30 days. This is often an indicator of cross-tenant impersonation abuse or credential misuse, particularly related to Actor Tokens.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Correlates an MFA method change with the next sign-in occurring from an ASN/country never seen for that user in 30 days, operationalizing TrustSphere's 2026 finding that reset-then-new-location access is the clearest signal separating a hijack from a genuine recovery.
Flags installation of RMM tools (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop) on an endpoint shortly after that user's account undergoes a password/MFA reset — matches the post-vishing tooling pattern CrowdStrike attributes to Mutant Spider (loaders including PrionFlaire and SocksLoader) and Scattered Spider.
Flags changes to a user's registered SMS/voice MFA phone number followed by a successful high-risk sign-in — the SIM-swap/SMS-interception bypass step documented across the 2024-2026 vishing threat-report taxonomy (CrowdStrike, Mandiant, Pindrop).
Detects a potential OAuth device code phishing abuse pattern where an authenticated device code sign-in is immediately followed by a new device registration or Primary Refresh Token (PRT) issuance for the same user, potentially originating from a different device or IP address.
This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.
Detects a suspicious sequence of identity-related operations performed by a single user within a 2-hour window. The chain consists of a password reset, MFA method modification, new device registration, and a subsequent privilege escalation event (such as role assignment or application consent). This pattern is consistent with helpdesk-vishing campaigns often used by threat actors like Scattered Spider to perform full account takeovers.
Detects anomalous NTLM network logons (Logon Type 3) where the same user account authenticates to multiple distinct hosts within a short time window. This behavior is correlated with NTLM validation (4776) events to identify potential Pass-the-Hash activity used for lateral movement.
Detects successful user sign-ins from geographically distant locations occurring within a timeframe that is physically impossible to traverse (implied speed > 900 km/h). The rule further filters for scenarios where the device used for authentication appears non-compliant or uses an unrecognized method, potentially indicating an attacker utilizing stolen credentials and bypassing MFA.
Detects anomalous lateral movement behavior where a single user account authenticates via NTLM to three or more distinct target hosts within a short time window (10 minutes). This pattern of rapid, broad authentication is a strong indicator of a Pass-the-Hash (PtH) attack.
Detects the issuance or renewal of Kerberos Ticket-Granting Tickets (TGT) (Event IDs 4768 and 4769) where the ticket lifetime or renewal duration exceeds standard Windows domain Kerberos policy defaults (typically 10 hours for lifetime and 7 days for renewal). Deviations from these standard thresholds are common indicators of forged Golden Tickets created using an exfiltrated KRBTGT hash.
Detects a sequence of events where a user's MFA configuration is modified (typically via a help-desk impersonation vishing attack) followed closely by a successful sign-in from a new IP address. This pattern is indicative of attackers hijacking sessions or stealing credentials by coercing victims into resetting MFA settings.
Detects Azure sign-in events claiming successful hardware-key or FIDO2 authentication where the authentication issuer is not part of a known-good allow-list. This behavior is indicative of a rogue MFA provider, such as the TrustSink attack, which issues forged tokens claiming MFA requirements were satisfied.
Detects Azure AD user sign-ins from multiple distinct IP addresses or countries within a 1-hour window. This is a common heuristic used to identify potentially compromised credentials or impossible travel scenarios, where a single user account authenticates from geographically distant or disparate network locations in an unrealistic timeframe.
This rule identifies potential Adversary-in-the-Middle (AiTM) activity by detecting multiple successful MFA-authenticated logins for the same user within a short timeframe, originating from different IP addresses/ASNs and featuring inconsistent user agents or non-managed device traits. This pattern is characteristic of session hijacking via phishing kits such as EvilProxy, Mamba2FA, or Tycoon2FA, where the attacker replays the stolen session token after the user has completed the MFA flow.
Page 21 of 80