Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,667 detections
Filters
Last updated
All Time
Detection languages
1,078
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,456
11,839
5,876
5,155
4,865
1,667
Platforms
1,092
591
440
252
122
Products / Services
1,131
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
This rule detects a sequence of events where a database user record is updated (inserting a new password hash) followed by a successful authentication for that same user, immediately following a recent login failure. This pattern is indicative of an attacker modifying credentials and then testing the new access.
This rule monitors for additions to the 'Domain Admins' group (Event IDs 4728, 4732, 4756) that occur within 15 minutes of an authentication event (Event ID 4624) involving accounts associated with PaperCut software on a Domain Controller. This pattern is indicative of a potential follow-on action after a PaperCut exploitation incident, where an attacker leverages initial access to perform privilege escalation.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects Microsoft Entra ID service principal (app-only) sign-in events where an application accesses a resource or tenant that has not been observed in the previous 30 days. This is often an indicator of cross-tenant impersonation abuse or credential misuse, particularly related to Actor Tokens.
Detects Microsoft Entra ID service principal (app-only) sign-in events where an application accesses a resource or tenant that has not been observed in the previous 30 days. This is often an indicator of cross-tenant impersonation abuse or credential misuse, particularly related to Actor Tokens.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Correlates new OAuth application consent grants with a preceding helpdesk-driven password/MFA reset on the same user, catching attacker-installed OAuth persistence — echoes the 2026 Vercel/Context.ai OAuth-abuse incident that followed a similar trust-granting pattern.
Detects a suspicious pattern where a user account experiences a burst of multiple MFA failures followed by an anomalous successful authentication within a short 15-minute window. This behavior is indicative of automated MFA fatigue attacks or attempts to exploit MFA bypass vulnerabilities.
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks by identifying an initial legitimate sign-in followed by a second sign-in from a different IP address within a short timeframe (indicative of session token replay), immediately succeeded by high-risk post-compromise actions such as OAuth application consent or the creation of malicious mailbox rules.
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
Detects successful VPN authentication events targeting SonicWall devices during non-business hours (between 20:00 and 06:00, or on weekends). This behavior is characteristic of initial access tradecraft often employed by ransomware affiliates to gain network entry with minimal operational noise.
Detects successful remote authentication events originating from an external source IP address via a SonicWall SSL-VPN, as identified by relevant login fields. This rule serves as a proxy for identifying initial access attempts often associated with ransomware activity, such as Akira, which leverage compromised VPN credentials.
Detects anomalous activity where a user performs a device-code authentication followed rapidly by a device registration event and the subsequent issuance of a Primary Refresh Token (PRT) or x-ms-RefreshTokenCredential. This pattern is often indicative of OAuth device-authorization flow abuse, where an adversary attempts to register a malicious device to gain persistent access.
Detects instances where a user signs in via a Device Code authentication flow and subsequently adds a member to a highly privileged group (e.g., Domain Admins, Global Administrators) within one hour. This behavior is indicative of potential account compromise where an attacker uses an OAuth device code flow to establish access and then escalates privileges.
Detects suspicious device registration or join events occurring within 60 minutes of a Device Code authentication flow. This pattern is consistent with the ARToken post-compromise technique, where an adversary uses an intercepted authentication code to register a new device to maintain persistent access to an Entra ID (Azure AD) environment.
Detects successful authentication events using the OAuth 2.0 Device Code flow, which is frequently leveraged by adversaries to perform phishing attacks and bypass traditional interactive login requirements.
Detects interactive sign-ins to Microsoft Entra ID using the OAuth 2.0 device authorization grant flow. Attackers commonly abuse this flow in 'device code phishing' campaigns to capture access and refresh tokens, effectively bypassing MFA requirements.
Detects anomalous, non-interactive Microsoft 365 sign-in events where an authentication session bypasses MFA via a previously issued token claim or device-code flow, indicative of ARToken or similar session hijacking and token replay attacks.
Detects suspicious Entra ID (Azure AD) events related to device registration, Primary Refresh Token (PRT) issuance, and account-level flags (such as 'enforceMfa' or broker mode) that are indicative of persistence techniques used in device code phishing campaigns, such as the ARToken platform.
This rule is a placeholder intended to detect abuse of the OAuth device code authentication flow. The current logic attempts to identify successful logins associated with authentication failure reasons; however, the rule author notes that the necessary data source (Azure AD/Entra ID logs) is missing from the SentinelOne SDL event lake, making this detection non-functional for its stated purpose.
Page 29 of 80