Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
315 detections
Filters
Last updated
All Time
Detection languages
140
65
56
27
13
Contributors
116
51
30
16
13
Categories
94
93
89
75
71
Platforms
116
85
80
75
62
Products / Services
95
84
60
53
42
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
1
1
1
1
IDS Classtypes
32
31
1
1
1
IDS Protocols
41
13
2
2
1
Detects the download of a JavaScript module named JSCeal, which contains code indicative of an HTTPS interception proxy. The rule looks for Node.js-based server creation code combined with cryptographic operations like keypair generation, certificate creation, and PEM conversion, excluding common legitimate JavaScript libraries and CDNs.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
This rule correlates successful Microsoft 365 sign-in events with preceding network events involving identified NovaCookies AiTM phishing infrastructure (specifically targeting .vu domains or specific URL patterns). It triggers when a user successfully authenticates using MFA shortly after accessing a known phishing link, which is a strong indicator of an active AiTM session hijacking attempt.
Detects anomalous reuse of an authenticated Microsoft 365 session cookie shortly after a successful MFA-satisfied sign-in. The detection identifies scenarios where the subsequent access originates from a different IP address, device, or user agent without an intervening MFA challenge, which is a pattern indicative of session hijacking techniques like Adversary-in-the-Middle (AiTM) or session token replay.
Detects anomalous sign-in behavior shortly after a successful MFA-authenticated session in Microsoft 365. This rule flags scenarios where a subsequent session for the same user occurs within a short window (30 minutes) from a different IP, ASN, User-Agent, or device identifier, potentially indicating the replay of a stolen session cookie obtained via Adversary-in-the-Middle (AiTM) phishing.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
Detects Microsoft-branded phishing pages served from non-Microsoft domains, the subsequent credential submission, and the establishment of a WebSocket relay connection characteristic of the Mirage2FA Adversary-in-the-Middle (AiTM) toolkit. This rule correlates multiple stages of the phishing flow to identify active proxy-based credential and MFA bypass attempts.
Detects a process other than screensharingd binding to macOS Screen Sharing port 5900 shortly after being newly spawned, indicating potential exploitation of the CVE-2026-43779 connection-interception logic flaw.
Detects a process other than screensharingd bound to or handling network traffic on screensharingd's expected port (5900), indicating exploitation of the connection-interception logic flaw (CVE-2026-43779).
This rule detects Azure AD sign-in attempts to the 'OfficeHome' application resulting in error code 90014. This specific error indicates that the OAuth flow was initiated without the required nonce parameter, a behavior frequently observed when adversary-in-the-middle (AiTM) phishing kits relay authentication flows incorrectly. The rule highlights the significance of this error when correlated with implausible user-agent and operating system combinations.
Detects OfficeHome sign-ins with error 90014 (nonce omission) followed by anomalous successful sign-ins from a different IP, or repeated 90014 failures, consistent with AiTM token replay activity.
Detects HTTP requests to known Storm-2755 Payroll Pirates AiTM lookalike proxy domains that also reference Microsoft authentication infrastructure in the URI, indicating a reverse-proxy phishing kit relaying to real Microsoft login endpoints.
This rule detects high-frequency, potentially malicious network connections to external infrastructure using unencrypted legacy mail protocols (SMTP: 25, POP3: 110, IMAP: 143). This pattern is consistent with an adversary-in-the-middle (AiTM) attack, where an attacker intercepts email traffic—often following DNS hijacking—to relay and potentially decrypt or harvest credentials and session tokens from plaintext sessions.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Detects POST requests to the Storm-2755 Payroll Pirates AiTM toolkit fingerprinting endpoint URI pattern co-occurring with the distinctive openresty/PHP response header combination.
Detects HTTP requests to known UNC6671 AiTM reverse-proxy phishing kit IPs on MFA/OTP interception URI paths (push-tap, duo-push, oauth2 2fa, community verify), indicating live MFA bypass.
Detects a single Entra ID session (SessionId) being used from two different countries within one hour at a travel velocity no physical journey could achieve. This is a signature of a stolen session/refresh token being replayed by an actor from a different location than the legitimate user.
This rule monitors web browser URL click events for specific patterns (createssopasskey, addssopasskey) often used in vishing-lure campaigns. It identifies potential Adversary-in-the-Middle (AiTM) credential harvesting attempts by cross-referencing clicked URLs against an organization's approved SSO domain allowlist and verifying the presence of an internal referrer in the redirect chain. If a user clicks a suspect link that does not originate from a known internal source and points to an unauthorized external domain, the event is flagged.
Detects AiTM phishing page geolocation fingerprint script referencing api.country.is, setting an rcfh_country cookie, and redirecting via oauth2/v2.0/authorize.
This rule identifies potential post-Adversary-in-the-Middle (AiTM) session hijacking by correlating suspicious initial authentication events (e.g., AiTM indicators, unusual behavioral flags) with subsequent successful sign-ins originating from known residential proxies or anonymization VPN providers within a 24-hour window.
Detects signs of Adversary-in-the-Middle (AiTM) token or session replay attacks by correlating device browsing activity on known phishing domains with subsequent user sign-in events. The rule triggers if a sign-in occurs within 10 minutes of a phishing-domain visit from a different, non-corporate IP address, or if a single session exhibits multiple distinct non-corporate IP addresses within that same window.
Page 8 of 15