Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,456
11,839
5,876
5,155
4,865
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
Detects the creation of applications, service principals, or delegated permission grants in Entra ID where the initiating User-Agent string contains 'python-requests'. This pattern is often indicative of programmatic interaction with Microsoft Graph API using standard Python libraries, which may be associated with automated malicious registration chains or unauthorized application persistence.
Detects the creation of an application or service principal followed quickly (within 1 hour) by a tenant-wide delegated permission grant scoped to 'AllPrincipals' with 'openid' and 'profile' permissions. This sequence is a known indicator of automated rogue Enterprise Application setup, often used in consent phishing or persistence campaigns.
This rule identifies sign-in events using an External Authentication Method (EAM) that occur within the 2-day cache window immediately following a certificate or key credential update for an application or service principal in Entra ID. This detection highlights a timeframe where an attacker potentially possessing a compromised old signing key could use it to forge tokens before the Entra cache refreshes.
This rule detects potential account hijacking via OAuth device-code authorization flow, specifically identifying patterns associated with phishing kits (e.g., EvilTokens, ARToken). It monitors sign-in events where the device code flow is utilized, specifically flagging successful grants that potentially bypass standard interactive credential prompts.
Detects a sequence of events where a user performs a device-code authentication followed rapidly by a device enrollment, and subsequently continues to access cloud services (Microsoft Graph, Exchange Online, Intune) shortly after their account password has been reset. This pattern is indicative of persistent access maintained via a registered device or OAuth token that survives credential remediation.
Detects Azure AD/Entra ID authentication events where a session token or cookie is used without performing a fresh interactive MFA challenge, which is characteristic of session hijacking or adversary-in-the-middle (AiTM) relay attacks (e.g., NovaCookies) used to bypass security controls after initial authentication.
Detects Microsoft 365 sign-in events where MFA was successfully satisfied, but the sign-in is simultaneously flagged by risk detection engines as exhibiting anomalous token or session characteristics, indicative of Adversary-in-the-Middle (AiTM) session hijacking.
Detects anomalous sign-in attempts to the OfficeHome application that result in OAuth error 90014 (frequently associated with application access issues or invalid consent) combined with an implausible mismatch between the reported Windows 10 operating system and mobile-specific browser user agents (e.g., Mobile Safari, Chrome Mobile). This behavior may indicate an adversary attempting to mimic legitimate device traffic to bypass conditional access policies or facilitate OAuth-based token manipulation.
Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.
Detects anomalous Microsoft Graph API activity characterized by user enumeration or querying for sensitive organizational groups (e.g., payroll, finance, HR) often associated with post-AiTM account-takeover reconnaissance. This detection specifically identifies multiple requests for sensitive URIs or high-count enumeration requests originating from suspicious User-Agent strings like 'axios/1.18.1', commonly observed in threat actor activity such as Storm-2755.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Detects potential abuse of stolen OAuth session tokens, where refresh tokens are used to authenticate after a user has performed a password reset. This rule identifies accounts that continue to sign in from previously unseen devices or IP addresses within 24 hours post-password reset, a technique consistent with session persistence mechanisms used by adversary tools and platforms like EvilTokens.
Detects an administrator account rapidly granting mailbox permissions (Add-MailboxPermission, Add-RecipientPermission, Set-MailboxFolderPermission) to a large number of objects within a short timeframe (15 minutes). The rule correlates this activity with a prior 'risky' sign-in or a sign-in using device-code flow, indicative of potential EvilToken or similar adversary-in-the-middle proxy-based session hijacking.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Page 36 of 135