Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
170 detections
Filters
Last updated
All Time
Detection languages
70
30
24
17
15
Contributors
49
33
20
8
8
Categories
104
61
51
49
42
Platforms
93
64
28
16
15
Products / Services
99
41
24
23
21
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
IDS Classtypes
3
3
3
IDS Protocols
9
Detects a sequence of authentication events from a specific IP address associated with the Microsoft Authentication Broker app, where an initial MFA challenge (ResultType 50199 - MFA challenge) is followed by a successful authentication (ResultType 0). This pattern is indicative of MFA fatigue attacks where an adversary repeatedly prompts a user until they inadvertently approve the request.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects potential multi-factor authentication (MFA) fatigue attacks in Azure AD by identifying a high number of push notification MFA challenges for a single user from a specific IP address within a short time frame. Specifically, it looks for 15 or more push notification MFA challenges within a 30-minute window.
This rule detects a potential MFA fatigue attack by identifying users who experienced a high volume of denied MFA requests (5 or more) followed by at least one successful authentication within a 15-minute window across Okta and Azure Active Directory platforms.
Detects high frequency of denied Multi-Factor Authentication (MFA) requests for a specific user and IP address, indicating potential 'MFA fatigue' or 'MFA bombing' attacks where an adversary attempts to force a user to approve a push notification or code verification.
This rule detects a potential MFA fatigue attack by identifying users who experienced a high volume of denied MFA requests (5 or more) followed by at least one successful authentication within a 15-minute window across Okta and Azure Active Directory platforms.
Detects high frequency of denied Multi-Factor Authentication (MFA) requests for a specific user and IP address, indicating potential 'MFA fatigue' or 'MFA bombing' attacks where an adversary attempts to force a user to approve a push notification or code verification.
Device Code Phishing Attempt
Cortex XDR
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of a phishing attack where an adversary is trying to steal application access tokens.
Detects MFA push bombing attacks by identifying a high volume of MFA challenge failures (errorCode 500121) associated with a single user account within a short time window. This activity often indicates an attempt to overwhelm or fatigue a user into inadvertently approving an MFA request.
Detects high-volume failed authentication attempts targeting a specific user account from a source IP address, indicative of 'MFA fatigue' or 'push bombing' attacks. This rule monitors endpoint-visible logon failure events as captured by EDR telemetry to identify potential attempts to circumvent multi-factor authentication by spamming the user with requests.
Device Code Phishing Attempt
Cortex XDR
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of a phishing attack where an adversary is trying to gain access to a user's application access token.
Detects MFA fatigue attacks via repeated authentication push requests
Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.
This rule detects network events where the 'AdditionalFields' contain keywords commonly associated with Multi-Factor Authentication (MFA) such as 'otp', 'verify', '2fa', or 'mfa', and the 'RemoteIP' is a valid IPv4 address. This could indicate attempts to interact with, or potentially bypass, MFA mechanisms.
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.
This rule detects a burst of Okta Multi-Factor Authentication (MFA) push prompts to a single user within a short time window, indicating a potential MFA bombing or fatigue attack. It specifically looks for scenarios where at least 5 push notifications are sent, and at least one is approved, suggesting the user might have caved under pressure. The rule also enriches the data with client IP, geographical context, and proxy information to aid investigation.
Detects MFA push bombing attacks by identifying a high volume of MFA challenge failures (errorCode 500121) associated with a single user account within a short time window. This activity often indicates an attempt to overwhelm or fatigue a user into inadvertently approving an MFA request.
Detects anomalous AWS API activity immediately following a successful ConsoleLogin event for the same user. This behavior is indicative of a session replay attack, often associated with AiTM phishing kits like PoisonSeeds, where a victim's session cookie is harvested and immediately reused by an attacker to programmatically access the AWS environment.
Detects anomalous authentication behavior consistent with an Adversary-in-the-Middle (AiTM) attack, where a single user account triggers multiple MFA challenge requests from distinct source IP addresses within a two-minute window. This behavior is indicative of an adversary proxying authentication requests in real-time between the user and a legitimate service.
Page 4 of 9