Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
44
6
2
Contributors
52
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
20
20
11
4
4
Products / Services
13
8
7
5
5
MITRE Techniques
21
12
12
5
5
CVEs
9
1
1
Detects additions to privileged groups (e.g. Domain Admins) or modification of password-change-policy flags on a previously dormant account being reactivated, excluding changes linked to an approved change-management ticket and weighting more heavily for off-hours or non-standard admin workstation origin.
Detects OfficeHome sign-ins with error 90014 (nonce omission) followed by anomalous successful sign-ins from a different IP, or repeated 90014 failures, consistent with AiTM token replay activity.
Detects bursts of 10+ MailItemsAccessed events within 60 seconds via a REST client with a specific ClientAppId/APIId pairing, consistent with automated mailbox collection using a replayed AiTM-stolen session token.
Detects pass-the-hash and pass-the-ticket lateral authentication using NTLM/Kerberos-ticket reuse across multiple hosts without a corresponding interactive logon, excluding known NTLM-by-design service accounts.
Detects use of default SSL-VPN administrator credentials from external or unusual source geographies after production provisioning, where account-lockout controls are absent — the initial-access vector observed in Gunra intrusions.
Detects a single user account signing into OfficeHome from 3+ distinct proxy/anyIP-flagged IP addresses within a 15-minute window, consistent with AiTM session replay from rotating residential proxy infrastructure.
Detects creation of the malicious persistent 'forticloud-sync' super-user account on FortiOS following an anomalous admin WebSocket session, consistent with post-exploitation of CVE-2024-55591/CVE-2025-24472.
Detects creation of malicious Exchange inbox rules (move to Deleted Items / mark as read) correlated via SessionId to an interactive sign-in from the Datawagon hosting ASN (27176) and a subsequent MailItemsAccessed event, consistent with Storm-2755 AiTM session-replay and mailbox-hiding persistence.
Detects cross-region GraphApiAuditEvents calls for the same AccountObjectId/ApplicationId occurring faster than plausible travel time, indicating a replayed/stolen session token.
Detects the drop of Gunra's static ransom note file R3ADM3.txt matched by exact filename and content signature, and exact-match usage of known Gunra ransom-negotiation email addresses.
Detects browser session-cookie database access followed by session reuse under impossible-travel or concurrent-session conditions, consistent with Gunra's VDI session-hijacking technique.
Detects Outlook sign-ins that reuse the same SessionId roughly every 8 hours while source IP/ASN change, consistent with attackers replaying a stolen AiTM-captured session token through rotating residential proxy infrastructure.
Detects SSH access to the Hiware system access-control server from accounts/source IPs outside the approved PAM admin allowlist, followed by bulk password-database export, consistent with Gunra's symmetric-key theft and mass credential decryption.
Detects AiTM reverse-proxy pages injecting the ServerData=$Config script alongside a redirUrl/api.country.is capture script and a rewritten login.microsoftonline.com authorize path hosted on a non-Microsoft domain, used to steal OAuth2 session tokens and bypass MFA.
Detects unauthorized modification of VDI/authentication-portal files implementing a hard-coded OTP-acceptance bypass, a specific Gunra MFA-tampering technique distinguished from routine MFA policy changes.
Detects non-interactive token refreshes occurring at anomalously consistent short intervals or from previously unseen IPs/devices, consistent with AiTM stolen session token replay used to maintain persistent access.
Detects abuse of Google Cloud Authenticator device-management API calls associated with the Pass-ta-key attack, where an attacker-controlled key is introduced or a device is de-registered without a legitimate biometric/attestation ceremony. Covers device/register with keys/genpair, device/add_uv_key, and device/forget commands observed in cloud authenticator device-management event logs. To reduce false positives, device/add_uv_key and device/forget calls only alert when they lack an associated preceding hardware attestation or biometric ceremony event, and legitimate user-initiated new-device enrollment (following a known legitimate sign-in with a prior MFA/biometric ceremony on the requesting device) and legitimate account-recovery flows are excluded.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Page 2 of 3