Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,667 detections
Filters
Last updated
All Time
Detection languages
1,078
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,456
11,839
5,876
5,155
4,865
1,667
Platforms
1,092
591
440
252
122
Products / Services
1,131
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
Detects non-interactive sign-in activity using a Primary Refresh Token (PRT) occurring shortly after a risky or AiTM-flagged interactive sign-in for the same user, originating from a device that has not been previously associated with that user account.
This rule detects instances where a user grants high-risk OAuth application permissions (e.g., Mail or Files access) within 30 minutes of a risky or MFA-challenged sign-in event. This pattern is indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker successfully steals a session and immediately establishes persistent access to the victim's resources via OAuth consent.
Detects successful Azure AD sign-in attempts that utilize legacy or basic authentication protocols (e.g., POP, IMAP, SMTP, Exchange ActiveSync) where Conditional Access MFA enforcement was not applied. This behavior indicates a potential attempt to circumvent modern authentication security controls, often associated with AiTM-facilitated account takeover or legacy protocol abuse.
Detects high-risk sign-in events in Azure AD that exhibit indicators of token replay, impossible travel, or anomalous sessions, while simultaneously leveraging certificate-based authentication or valid Primary Refresh Tokens (PRT). This combination often indicates an adversary is using stolen session material or PRTs to establish persistent, MFA-exempt access to the environment.
Detects successful sign-in events using the OAuth 2.0 device authorization grant (device code flow). This technique is frequently abused in AiTM/consent-phishing campaigns where an adversary tricks a user into authorizing a device, effectively obtaining a fully authenticated session token. The rule identifies successful device-code authentications, which should be correlated with source IP discrepancies or unusual volume per tenant to identify malicious activity.
Detects successful Azure AD sign-in events where the session is marked as compliant or trusted by Conditional Access policies, but simultaneously flagged by Identity Protection as originating from an anonymized IP (e.g., residential proxy, VPN). This indicates an adversary has bypassed location-based Conditional Access controls, likely in the context of an Adversary-in-the-Middle (AiTM) phishing attack.
Detects the reuse of a single authenticated session or refresh token from multiple distinct IP addresses or ASN origins within a short timeframe following a successful MFA event. This pattern is indicative of session hijacking, where an adversary uses an Adversary-in-the-Middle (AiTM) toolkit (e.g., Evilginx) to capture a valid session cookie from a victim and replay it from their own infrastructure to bypass authentication.
Detects successful multi-factor authentication (MFA) events associated with risk signals categorized as 'unfamiliarFeatures' in Azure AD sign-in logs. This combination is often indicative of an adversary-in-the-middle (AiTM) attack, where the attacker has captured authentication tokens or is forcing an MFA prompt and receiving immediate approval from a new or suspicious device and network location.
Detects a suspicious authentication pattern involving 3 or more MFA failures within 15 minutes, immediately followed by an MFA success for the same user. This pattern is characteristic of potential Adversary-in-the-Middle (AiTM) activity, where an attacker intercepts a session or MFA token and relays it through separate infrastructure, while the legitimate user's own MFA attempts fail or time out.
Detects successful sign-in events flagged by the identity provider with risk indicators suggesting session token replay or theft. This includes anomalies such as unexpected token issuers, suspicious browsers, or unfamiliar device features, which are characteristic of session cookie theft and replay attacks.
Detects instances where an existing, non-interactive SSO session token is reused from a suspicious network location, such as an anonymizing proxy, VPN, or VPS, or triggered by an impossible travel risk event. The rule specifically looks for token usage that lacks a fresh interactive Multi-Factor Authentication (MFA) challenge, a common indicator of session token hijacking or 'replay' attacks frequently used in cloud account takeover campaigns.
Detects SAML token authentication events where the token-signing certificate does not match the established federation baseline (indicating potential token forging or unauthorized IdP activity) or where critical conditional access claims (MFA and device compliance) are missing from the SAML assertion.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects instances where a user successfully authenticates via the OAuth Device Code flow using an unmanaged or non-compliant device, followed closely by high-privileged Azure/Graph API administrative actions within a short timeframe. This behavior is indicative of a device-code phishing attack aimed at bypassing MFA controls, including FIDO2/passkeys, by compromising an active session.
This rule detects potential 'Quishing' (QR code phishing) attempts by identifying email-based phishing detection or malicious URL indicators followed by a user clicking the URL and subsequently authenticating to a corporate system from a mobile device (Android or iOS) within a 30-minute window. This behavior often suggests an adversary successfully harvesting credentials via a QR code link and then using them to gain unauthorized access.
Page 24 of 80