Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
47 detections
Filters
Last updated
All Time
Detection languages
23
6
6
6
3
Contributors
17
7
5
5
4
Categories
22
22
11
10
10
Platforms
29
11
10
8
6
Products / Services
19
12
11
9
6
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
4
1
IDS Classtypes
4
2
IDS Protocols
6
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects Entra ID sign-in failures with error code AADSTS500172, indicating that a federated SAML assertion was rejected due to invalid or stale token-signing material. This may indicate an attempt to use a forged or recovered SAML token (e.g., Golden SAML) where the signing key is no longer valid or recognized.
Detects Active Directory Federation Services (ADFS) token issuance or claims processing events (Event IDs 299, 1200-1203) that lack a corresponding preceding primary authentication audit event within the same correlation instance. This lack of correlation suggests the SAML assertion was not initiated by a legitimate login, potentially indicating the use of a forged SAML token (Golden SAML attack).
Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects the use of the AADInternals PowerShell module for suspicious device registration activities, such as phantom device creation and Primary Refresh Token (PRT) manipulation, which are common techniques used to bypass Conditional Access policies. The rule correlates PowerShell command execution containing AADInternals cmdlets with subsequent Azure AD device registration events originating from the same host within a 15-minute window.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects a mismatched/synthetic iOS 18 User-Agent (Version/26.x) used by Kali365 to bypass detection. This specific User-Agent string is indicative of malicious activity as 'Version/26' does not natively exist on iOS 18.
Detects forged Golden SAML tokens used for identity federation bypass
Detects forged Golden SAML tokens used for identity federation bypass
Detects use of forged web credentials for unauthorized application access
This rule detects the submission of a Golden SAML attack token to a service. It specifically looks for HTTP POST requests where the URI contains 'saml', the client body contains 'Assertion', and the body size is greater than 2000 bytes. This combination of indicators suggests an attempt to authenticate using a forged SAML assertion.
This rule detects the use of a forged SAML token for identity federation bypass. It specifically looks for HTTP POST requests (flow:to_server,established; http.client_body;) containing the string "SAMLResponse" (content:"SAMLResponse"; nocase;) and a long base64-encoded string (pcre:"/[A-Za-z0-9+\/]{500,}={0,2}/";) within the client body. The presence of a large base64 string in conjunction with "SAMLResponse" suggests a potentially malicious SAML assertion being submitted.
Detects modifications to Azure AD federation settings or domain authentication methods. Such changes can be indicative of a Golden SAML attack, where an attacker establishes a new federation trust to forge SAML tokens and gain unauthorized access.
Detects potential JSON Web Token (JWT) algorithm confusion attacks. This occurs when an attacker sends a token signed with a symmetric algorithm (e.g., HS256) to a server expecting an asymmetric one (e.g., RS256). If the server is misconfigured, it may use its public key as the HMAC secret, allowing the attacker to forge valid tokens. The rule specifically looks for JWTs with symmetric HMAC-based algorithms (HS256, HS384, HS512) being sent to applications configured to exclusively use asymmetric key algorithms.
This rule detects successful SSO logins on FortiGate devices using usernames and source IP addresses associated with a known malicious campaign exploiting a SAML SSO bypass. The rule specifically looks for successful SSO logins (logid == "0100032001", method == "sso", status == "success") from a predefined list of malicious usernames or source IP addresses.
KQL Query from file: Detecting GOLDEN SAML Attack
This query will find when federation trust settings are changed for a domain or when the domain is changed from managed to federated authentication. Results will relate to when a new Active Directory Federated Service (ADFS) TrustedRealm object, such as a signing certificate, is added.
Modification to domain federation settings should be rare, so confirm the added or modified target domain/URL is legitimate administrative behavior.
The actor, Nobelium, was observed modifying domain trust settings to subvert existing mechanisms and cause the domain to accept authorization tokens signed with actor-owned certificates. See Customer Guidance on Recent Nation-State Cyber Attacks.
To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see Update or repair the settings of a federated domain in Office 365, Azure, or Intune.
For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: 3.2.5.1.2.4 Security Realm Data.
For further information on AuditLogs, please see Microsoft Entra ID audit activity reference.
This query is inspired by an Azure Sentinal detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365
https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b
https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
Modification to domain federation settings should be rare, so confirm the added or modified target domain/URL is legitimate administrative behavior.
The actor, Nobelium, was observed modifying domain trust settings to subvert existing mechanisms and cause the domain to accept authorization tokens signed with actor-owned certificates. See Customer Guidance on Recent Nation-State Cyber Attacks.
To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see Update or repair the settings of a federated domain in Office 365, Azure, or Intune.
For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: 3.2.5.1.2.4 Security Realm Data.
For further information on AuditLogs, please see Microsoft Entra ID audit activity reference.
This query is inspired by an Azure Sentinal detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365
https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b
https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
The following analytic detects updates to the SAML provider in AWS. It leverages AWS CloudTrail logs to identify the `UpdateSAMLProvider` event, analyzing fields such as `sAMLProviderArn`, `sourceIPAddress`, and `userIdentity` details. Monitoring updates to the SAML provider is crucial as it may indicate a perimeter compromise of federated credentials or unauthorized backdoor access set by an attacker. If confirmed malicious, this activity could allow attackers to manipulate identity federation, potentially leading to unauthorized access to cloud resources and sensitive data.
The following analytic detects updates to the SAML provider in AWS. It leverages AWS CloudTrail logs to identify the `UpdateSAMLProvider` event, analyzing fields such as `sAMLProviderArn`, `sourceIPAddress`, and `userIdentity` details. Monitoring updates to the SAML provider is crucial as it may indicate a perimeter compromise of federated credentials or unauthorized backdoor access set by an attacker. If confirmed malicious, this activity could allow attackers to manipulate identity federation, potentially leading to unauthorized access to cloud resources and sensitive data.
Page 2 of 3