Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
44
6
2
Contributors
52
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
20
20
11
4
4
Products / Services
13
8
7
5
5
MITRE Techniques
21
12
12
5
5
CVEs
9
1
1
Detects OAuth2 token requests scoped to Google's secureidentity.action, used for passkey/security-domain-secret operations. Chrome's own sync/passkey process routinely requests this scope from the browser, so those requests (identified by a Chrome User-Agent) are excluded. Remaining matches indicate the token request did not originate from the legitimate Chrome browser process (e.g. a non-browser client, script, or tool crafting the request directly), which is anomalous and warrants investigation for possible passkey/security-domain-secret abuse or token reuse across devices.
Detects successful passkey/WebAuthn authentication or signing events where the User Verification (UV) flag is unset/false or no UV assertion accompanies a device-key signature, scoped to relying parties/credentials where UV is policy-required, or corroborated by a missing biometric/user-presence event or a static (unchanged) signature counter. This reduces noise from relying parties or lower-risk contexts that legitimately do not require UV on every assertion.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects OAuth2 token requests scoped to Google's secureidentity.action, used for passkey/security-domain-secret operations. Chrome's own sync/passkey process routinely requests this scope from the browser, so those requests (identified by a Chrome User-Agent) are excluded. Remaining matches indicate the token request did not originate from the legitimate Chrome browser process (e.g. a non-browser client, script, or tool crafting the request directly), which is anomalous and warrants investigation for possible passkey/security-domain-secret abuse or token reuse across devices.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects successful passkey/WebAuthn authentication or signing events where the User Verification (UV) flag is unset/false or no UV assertion accompanies a device-key signature, scoped to relying parties/credentials where UV is policy-required, or corroborated by a missing biometric/user-presence event or a static (unchanged) signature counter. This reduces noise from relying parties or lower-risk contexts that legitimately do not require UV on every assertion.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Page 3 of 3