Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
315 detections
Filters
Last updated
All Time
Detection languages
140
65
56
27
13
Contributors
116
51
30
16
13
Categories
94
93
89
75
71
Platforms
116
85
80
75
62
Products / Services
95
84
60
53
42
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
CVEs
2
1
1
1
1
IDS Classtypes
32
31
1
1
1
IDS Protocols
41
13
2
2
1
Detects network proxy requests indicative of Adversary-in-the-Middle (AiTM) phishing kits. The rule monitors for specific URL patterns associated with malicious JavaScript delivery, administrative panels, and connections to known malicious infrastructure hosting phishing activities.
Detects Microsoft 365 sign-in activity consistent with adversary-in-the-middle (AiTM) token theft. The rule identifies successful sign-ins with multi-factor authentication, immediately followed by a new session attempt for the same user within 30 minutes from a different device, IP address, or location.
Detects network activity associated with the FlowerStorm/Storm-1167 phishing campaign. The rule monitors for credential exfiltration to a specific malicious URI (e.g., /google.php) containing login parameters, as well as the delivery of spoofed Microsoft sign-in pages from the associated phishing infrastructure.
Detects network activity indicating interaction with known Adversary-in-the-Middle (AiTM) phishing infrastructure. This includes direct outbound connections to specific suspicious IP addresses and the identification of proxied Microsoft 365 OAuth authorization flows redirected to non-Microsoft hosts.
This rule detects indicators of Browser-in-the-Browser (BitB) phishing attacks within web proxy traffic. It monitors for suspicious HTML markup mimicking browser UI elements, such as fake title bars and URL bars, as well as specific window dimensions and authentication lures that deviate from known legitimate identity provider patterns.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
This rule identifies potential Adversary-in-the-Middle (AiTM) activity by detecting multiple successful MFA-authenticated logins for the same user within a short timeframe, originating from different IP addresses/ASNs and featuring inconsistent user agents or non-managed device traits. This pattern is characteristic of session hijacking via phishing kits such as EvilProxy, Mamba2FA, or Tycoon2FA, where the attacker replays the stolen session token after the user has completed the MFA flow.
Detects anomalous authentication behavior where the same session token or identifier is utilized by multiple distinct IP addresses or User-Agent strings within a short timeframe. This behavior is indicative of Adversary-in-the-Middle (AiTM) attacks, such as those employing Evilginx, where an attacker intercepts and replays stolen session cookies to bypass standard authentication and MFA controls.
Detects outbound network connections (HTTP/TLS) from internal hosts to a known malicious IP address associated with Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Microsoft 365 credential and session cookie theft.
Detects outbound network connections (HTTP/TLS) from internal hosts to a known malicious IP address associated with Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Microsoft 365 credential and session cookie theft.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by identifying a pattern where a successful multi-factor authentication sign-in event is quickly followed by another successful sign-in for the same user from a different IP address, device, or geographic location. This behavior is indicative of session cookie theft and replay, commonly associated with phishing toolkits like Evilginx or NovaCookies.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects Microsoft 365 sign-in events where MFA was successfully satisfied, but the sign-in is simultaneously flagged by risk detection engines as exhibiting anomalous token or session characteristics, indicative of Adversary-in-the-Middle (AiTM) session hijacking.
Detects the enrollment of a new security key or passkey shortly after an unfamiliar or suspicious sign-in event within Google Workspace. This behavior is indicative of an adversary establishing persistent access following a successful session hijack or credential phishing campaign, specifically targeting authentication mechanisms to bypass existing security controls.
Detects the specific fingerprinting sequence associated with Mirage2FA AiTM phishing campaigns. The detection triggers when a process downloads a specific JavaScript loader from an '/xls/' path, followed closely within two minutes by an IP/geolocation lookup request to common services (api.ipify.org, api.country.is, api.ipgeolocation.io), which is a characteristic precursor to credential interception.
Detects an adversary-in-the-middle (AiTM) phishing pattern where the legitimate Microsoft authentication URL is embedded as a sub-path within an attacker-controlled proxy domain. This technique is characteristic of AiTM kits, such as Evilginx2, which proxy the legitimate Microsoft authentication flow to capture credentials and session cookies.
Detects network traffic patterns indicative of adversary-in-the-middle (AiTM) phishing infrastructure. The rule identifies suspicious TLS Server Name Indication (SNI) strings matching common SaaS login portals (Microsoft, Okta, Google) paired with SSL/TLS certificates issued by 'Let's Encrypt' that contain suspicious subject names, suggesting a freshly generated infrastructure for credential harvesting.
Detects adversary-in-the-middle (AiTM) phishing activity utilizing reverse-proxy kits (such as Evilginx2, EvilProxy, or Modlishka) to bypass MFA. The rule identifies suspicious login requests by correlating common identity provider login paths with missing security headers (CSP/HSTS) and anomalous server or hostname characteristics typical of proxied phishing infrastructure.
Page 3 of 15