Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,443
11,831
5,875
5,151
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
Detects the registration of a new MFA authentication method (such as an authenticator app, phone, or software OTP) by a user, specifically flagging cases where the action occurs from an unfamiliar location or device context within 24 hours of a prior sign-in event. This pattern is often associated with post-compromise persistence efforts where attackers register their own MFA devices to maintain access to a compromised account.
Detects when a user account updates their multi-factor authentication (MFA) details to include a higher count of registered devices than previously recorded. This behavior could indicate an attacker adding their own device to a compromised account to bypass MFA or maintain persistent access.
Detects anomalous activity in Microsoft Graph API logs where a single identity (user or application) performs a high volume of requests across multiple sensitive administrative categories, such as directory role management, authentication method modification, application or service principal changes, and OAuth consent operations. This pattern is indicative of potential unauthorized reconnaissance, privilege escalation, or persistence attempts within an Azure/Microsoft 365 environment.
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
This rule detects anomalous behavior where a single user account registers multiple devices within a very short timeframe (80 seconds). This pattern often follows the theft of a device code or OAuth authorization token, where an adversary attempts to rapidly enroll multiple rogue devices to maintain persistent access or bypass MFA controls.
Detects successful modifications to user MFA methods (StrongAuthenticationMethod) where the associated device details are missing or indicate a software-only token activation. This behavior is often indicative of an adversary adding their own MFA device to a compromised account to maintain persistent access or bypass MFA requirements.
Detects modifications to a user's Azure Active Directory (Entra ID) authentication methods where a new authentication device is added. The rule specifically monitors changes to 'StrongAuthenticationPhoneAppDetail' or 'StrongAuthenticationUserDetails' and identifies instances where the count of registered devices increases, potentially indicating an attacker adding a device for persistence or MFA bypass.
Detects instances where a user account experiences an 'Unusual sign-in' event followed by the registration of a new MFA or security information method within a one-hour window. This behavior is indicative of an attacker attempting to establish persistent access by registering their own authentication device to a compromised account.
This detection identifies enabled user accounts that have not had a successful sign-in for the last 90 days, highlighting potential security risks from dormant accounts.
Detects suspicious activities in GitHub audit logs that could indicate RepoJacking or SkillJacking attempts, specifically focusing on repository ownership transfers, default branch modifications, repository deletion, and changes to organizational membership or roles.
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
Detects the registration of a new MFA or security information method (such as StrongAuthenticationMethod, phone, or software OTP token) on an Azure AD/Entra account. This activity is often consistent with attacker-controlled MFA enrollment, used to maintain persistent access after an initial identity compromise, such as one resulting from passkey-themed phishing.
Detects a multi-stage cloud attack sequence involving a sign-in anomaly, modification of user authentication methods (e.g., registering an attacker-controlled device), reconnaissance using Microsoft Graph API, and subsequent abnormal data access/download, typically observed in Storm-3121 and Storm-3032 activities.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
This detection identifies enabled user accounts that have not had a successful sign-in for the last 90 days, highlighting potential security risks from dormant accounts.
This rule detects instances where a user account performs a password update without any preceding or associated account verification events (such as email verification, reset requests, or action execution) within a short timeframe. This behavior can be indicative of account compromise where an adversary modifies credentials for a compromised user account.
Detects the creation of new AWS access keys or login profiles for a target identity immediately following the deletion or modification of a credential for the same identity, where the actors performing the two actions are different. This pattern indicates an adversary creating persistent access after a security incident responder or automated system has revoked a previously compromised credential.
Page 11 of 29