Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
315 detections
Filters
Last updated
All Time
Detection languages
140
65
56
27
13
Contributors
116
51
30
16
13
Categories
94
93
89
75
71
Platforms
116
85
80
75
62
Products / Services
95
84
60
53
42
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
1
1
1
1
IDS Classtypes
32
31
1
1
1
IDS Protocols
41
13
2
2
1
Detects anomalous session activity where a single authentication session ID is associated with multiple IP addresses and multiple distinct countries within a 20-minute window. This behavior is indicative of session hijacking, such as an Adversary-in-the-Middle (AiTM) attack, where a session token is stolen and reused by an attacker from a different location.
Detects anomalous session activity where a single authentication session ID is associated with multiple IP addresses and multiple distinct countries within a 20-minute window. This behavior is indicative of session hijacking, such as an Adversary-in-the-Middle (AiTM) attack, where a session token is stolen and reused by an attacker from a different location.
Detects network and DNS traffic targeting known infrastructure used by the Forg365 adversary-in-the-middle (AiTM) phishing kit. This kit clones Microsoft login pages to intercept credentials and session cookies via reverse proxy.
UNC6671 AiTM Phishing Infrastructure - Maintained IOC Dataset Match with TTL-Based Expiry (High Confidence)
This rule detects potential Adversary-in-the-Middle (AiTM) activity by correlating network events indicating a connection to a known phishing domain with subsequent suspicious authentication behavior. Specifically, it identifies sessions associated with non-corporate IP addresses that show evidence of token reuse (e.g., multiple distinct IP addresses for the same session identifier) occurring within a short window after accessing a phishing portal.
Detects possible kernel-level WFP redirection of outbound HTTP connections to an unexpected local loopback proxy port while the original destination host header is retained, consistent with Phantom Mantis G12/G13 network redirection.
AiTM Phishing - PHPSESSID Cookie with Preload Flag and Word-Number Route Token
This rule detects DNS queries, HTTP Host headers, and TLS SNI values indicative of interaction with specific doppelganger domains designed to impersonate Microsoft online services (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com). Such activity is commonly associated with phishing or C2 infrastructure targeting Microsoft 365 environments.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. It monitors for suspicious network connections to known Evilginx-style subdomains (e.g., owa, sso, secure, billing) that proxy traffic to login.microsoftonline.com, followed immediately by a successful user login event on the same host. This pattern indicates an active session hijacking attempt designed to capture session cookies like ESTSAUTH and ESTSAUTHPERSISTENT.
This rule detects access to known adversary-in-the-middle (AiTM) phishing infrastructure mimicking Microsoft login pages. It identifies malicious URLs matching specific randomized path token patterns or those hosting a known phishing domain, while also monitoring for associated session-specific parameters such as 'rt=', 'PHPSESSID', and 'preload=1' cookies, as well as traffic interacting with legitimate 'login.microsoftonline.com' domains in a proxy context.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Detects potentially malicious use of the device code authentication flow in Entra ID sign-in logs. The rule correlates device code usage with indicators of suspicious activity, such as rare User-Agent strings (e.g., 'python-requests') often used in phishing/relay toolkits, or sign-ins flagged by Azure AD Identity Protection as risky. It includes exclusions for known first-party Azure CLI and PowerShell clients to minimize noise from legitimate administrative activity.
KQL Query from file: The Hunt for QR Phisher
This rule detects the execution of mitmproxy, mitmweb, or mitmdump in reverse-proxy mode configured specifically to target login.microsoftonline.com. This behavior is highly characteristic of an adversary setting up an Adversary-in-the-Middle (AiTM) platform to perform TLS interception on authentication traffic, potentially leading to credential and session cookie theft.
Detects the installation of an attacker-controlled root certificate into the Windows certificate store using certutil.exe. This activity is correlated with the modification of Firefox browser settings to trust the Windows OS certificate store, an action often performed to facilitate TLS interception and traffic stripping.
Detects anomalous non-interactive OAuth token requests against Microsoft Graph that claim multi-factor authentication (MFA) satisfaction from unmanaged devices. This behavior is indicative of Adversary-in-the-Middle (AiTM) token replay attacks, where captured session tokens are reused by an attacker to bypass authentication controls, consistent with tactics used by threat actors like Storm-2755 (Payroll Pirate).
Detects instances where a user account modifies sensitive payroll or banking information (e.g., direct deposit details) shortly after performing a sign-in from an unmanaged device or suspicious context. This behavior is indicative of an Adversary-in-the-Middle (AiTM) token replay attack targeting HR SaaS applications like Workday to perform financial fraud.
Detects the unauthorized addition or peering of rogue devices within a Cisco SD-WAN fabric. This rule monitors vManage and vBond logs for successful peering or registration events that correlate with known rogue indicators, such as certificate validation failures, mismatching system information, or untrusted peer identities. This activity is often indicative of attackers attempting to gain persistent control over the SD-WAN infrastructure, potentially using authentication bypass vulnerabilities or stolen credentials.
Detects a suspicious pattern where a user successfully authenticates via MFA, followed by another successful sign-in attempt for the same account within 10 minutes using a different IP address or user agent. This behavior is often indicative of session hijacking or adversary-in-the-middle (AiTM) attacks where a session token is stolen and replayed from an attacker-controlled environment.
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
Detects potential Microsoft 365 session token replay attacks, often associated with Adversary-in-the-Middle (AiTM) kits. The rule identifies suspicious sign-in activity originating from proxy or anonymized IP addresses where MFA was bypassed or incomplete, coupled with a geographic location that deviates from the user's established 30-day baseline or constitutes a new, unseen location.
Page 9 of 15