Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
985 detections
Filters
Last updated
All Time
Detection languages
640
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,875
5,151
4,864
985
Platforms
485
405
224
192
62
Products / Services
416
384
182
109
81
MITRE Techniques
498
497
264
235
234
CVEs
4
4
4
3
3
IDS Classtypes
1
This rule detects a correlation between high-risk or anomaly-flagged sign-ins and subsequent changes to B2B guest invitation or tenant collaboration policies by the same user account within a 30-minute window. This behavior is indicative of an adversary who has successfully hijacked a session (e.g., via AiTM or token replay) and is attempting to establish persistence or pivot by inviting external accounts or modifying B2B security settings.
Detects successful sign-in events using the OAuth 2.0 device authorization grant (device code flow). This technique is frequently abused in AiTM/consent-phishing campaigns where an adversary tricks a user into authorizing a device, effectively obtaining a fully authenticated session token. The rule identifies successful device-code authentications, which should be correlated with source IP discrepancies or unusual volume per tenant to identify malicious activity.
Detects NTLM network logon events (Logon Type 3) using the NtLmSsp process where the key length is zero. This pattern is often indicative of Pass-the-Hash (PtH) attacks where the adversary uses a NTLM hash for authentication without knowing the original plaintext password.
Detects anomalous authentication behavior consistent with Adversary-in-the-Middle (AiTM) phishing attacks, specifically where an MFA-authenticated session is accessed from multiple, disjoint geographic locations or IP addresses within a short timeframe, indicating the replay of stolen session tokens.
Detects high-volume authentication failures originating from a single source IP targeting multiple unique user accounts, indicative of password spraying or credential stuffing attacks against cloud identity providers.
Detects credential-stuffing campaigns that employ AI/ML-tuned inter-request timing jitter to bypass traditional rate-limiting and fixed-interval bot detection, specifically flagging interactive or network logon failures on Windows hosts.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects instances where a Temporary Access Pass (TAP) is assigned to a user account, followed by a sign-in from an unmanaged or non-compliant device within one hour. This behavior is indicative of potential help-desk impersonation (vishing) attacks where an adversary obtains a TAP to bypass standard authentication controls.
Detects rapid, machine-speed, sequential attack-path adaptation by suspected AI agent binaries. The rule monitors for a correlation of four stages occurring within a tight 20-minute window: 1) Failed service connections across three or more distinct protocols (SMB, SSH, HTTP, RDP, WinRM), 2) Credential access attempts (Logon events or execution of known credential-dumping tools), and 3) A lateral movement pivot to a new, previously un-targeted internal destination. The rule specifically keys on the InitiatingProcessId and InitiatingProcessCreationTime to ensure the sequence is attributed to a single process instance, distinguishing it from human manual penetration testing activity. Covers T1190, T1210, T1078
Flags privileged or helpdesk-support account access to the identity admin console from a never-before-seen device fingerprint within minutes of a password reset on any downstream user account.
Detects the use of anomalous session tokens in Azure Active Directory (Azure AD) sign-in events where the token is being used in a non-interactive manner without a corresponding interactive authentication event. This behavior is indicative of token theft or infostealer activity, where an adversary replays a stolen session cookie from a new, untrusted, or non-compliant device to bypass authentication protections.
This rule detects potential Pass-the-Hash lateral movement by identifying NTLM network logons (Event ID 4624, LogonType 3) on a host that lack a preceding interactive (LogonType 2, 10) or Kerberos-authenticated logon, coupled with subsequent access to sensitive administrative shares (Event ID 5140) by the same user account.
Detects successful user authentications originating from geographically distant locations within a time window that makes physical travel impossible. The detection further filters for scenarios where the subsequent sign-in is associated with a different, non-compliant, or untrusted device, indicating a likely compromised account.
Detects Azure AD sign-in events indicative of a session token replay attack. The rule identifies successful sign-ins where the traffic source originates from known residential proxy infrastructure (anonymizing services often used by attackers) and the authentication process lacks a fresh interactive MFA challenge, suggesting the use of a stolen, valid session token.
This rule detects potentially unauthorized device registration or Intune enrollment activity by monitoring Azure Sign-in logs. It specifically flags accounts that exhibit rapid, multiple device registration attempts (>= 2 in 5 minutes) combined with suspicious indicators such as scripted User Agents ('python-requests'), the presence of Primary Refresh Tokens (PRT), specific device naming patterns, or concurrent Intune enrollment activity. These behaviors are common indicators of automated adversary activity aiming to bypass conditional access policies by enrolling illicit devices.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects non-interactive sign-in events to common Microsoft 365 applications (OfficeHome, Outlook, My Sign-Ins, My Profile) where the User-Agent identifies as an automated HTTP client library (Axios or Python-requests). This behavior is often indicative of programmatic access via stolen session cookies or application tokens, commonly seen in adversary activity such as payroll-related business email compromise.
Detects anomalous sign-in activity where a single Microsoft 365 or Entra ID user account successfully authenticates from multiple distinct residential or mobile-carrier ASNs within a 24-hour window. This behavior is highly indicative of an adversary replaying stolen session tokens (AiTM) through rotating residential proxy networks to blend into legitimate user traffic and circumvent location-based or datacenter IP-based access restrictions.
Detects high-volume, automated enumeration of cloud resources (SharePoint, OneDrive, or Exchange) via Graph API or search queries immediately following a user sign-in event. This behavior is indicative of session hijacking (token replay) followed by unauthorized scripted discovery, as opposed to legitimate user browsing activity.
This rule detects potentially malicious messages within Microsoft Teams that use common social engineering keywords related to security configuration changes (e.g., passkey, MFA, SSO). The detection specifically filters for users who have successfully logged in within the last 30 days to identify potential compromised accounts acting as internal senders.
Page 13 of 47