Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,417
11,806
5,870
5,145
4,864
1,666
Platforms
1,091
590
440
252
122
Products / Services
1,130
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects anomalous certificate-based authentication attempts to Jasmine network services characterized by rapid, impossible-travel scenarios or geo-inconsistent session patterns. This behavior is indicative of a stolen certificate being reused from a different geographic location or network, bypassing standard authentication patterns.
Detects anomalous certificate-based authentication attempts to Jasmine network services characterized by rapid, impossible-travel scenarios or geo-inconsistent session patterns. This behavior is indicative of a stolen certificate being reused from a different geographic location or network, bypassing standard authentication patterns.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects potential device code authentication phishing attacks by correlating a successful device code authentication event with a subsequent non-interactive sign-in from a suspicious user agent (Python Requests or specific Outlook versions) within a 10-minute window. This behavior is indicative of an adversary using a device code phishing lure to capture a token or session, followed by automated access via a script or impersonated client.
This rule detects potentially malicious activity where a user performs a device code authentication followed by multiple rapid token exchanges (often of different types) within an extremely short time window. This pattern is indicative of an attacker attempting to leverage a compromised device code grant to programmatically retrieve access or refresh tokens before the user has completed a legitimate flow or to automate malicious access.
Detects instances where a user authenticates via the device code flow and subsequently performs a device enrollment or registration action from an unusual or non-compliant device naming convention. This pattern is indicative of an adversary enrolling their own device to bypass MFA or gain persistent access to corporate resources.
Detects an Azure AD Device Code authentication event followed within 60 seconds by a non-interactive Primary Refresh Token (PRT) sign-in event from the same user. This sequence is characteristic of adversary-in-the-middle (AiTM) phishing attacks where a user is tricked into authorizing a device code, and the adversary immediately leverages the resulting session/token to obtain a PRT for persistent access.
Detects instances where a user successfully authenticates using the OAuth Device Code flow followed by subsequent mailbox operations (such as reading, sending, or deleting items) from a different IP address within a 10-minute window. This behavior is a strong indicator of adversary-in-the-middle phishing attacks where an attacker captures a session token and utilizes it from a remote location.
This rule detects potential abuse of the device code authentication flow by correlating a successful device code login with a subsequent non-interactive sign-in using the 'python-requests' user agent for the same user within 10 minutes. This behavior is indicative of an attacker programmatically accessing resources or APIs immediately after gaining authorization via a device code phishing or relay attack.
This rule detects potential abuse of the device code authentication flow by correlating a successful device code login with a subsequent non-interactive sign-in using the 'python-requests' user agent for the same user within 10 minutes. This behavior is indicative of an attacker programmatically accessing resources or APIs immediately after gaining authorization via a device code phishing or relay attack.
Detects rapid rotation of multiple unique IP addresses originating from the same user account shortly after a device code authentication event. This behavior is indicative of threat actors using proxy rotation services (like FlashProxy) to obfuscate their origin and bypass location-based security controls or impossible-travel detections after hijacking a session.
Detects rapid rotation of multiple unique IP addresses originating from the same user account shortly after a device code authentication event. This behavior is indicative of threat actors using proxy rotation services (like FlashProxy) to obfuscate their origin and bypass location-based security controls or impossible-travel detections after hijacking a session.
Detects non-interactive Entra ID sign-ins utilizing the python-requests library, which suggests an automated polling mechanism. This is indicative of 'GhostCode' or similar device code phishing attacks where an adversary uses a stolen device code token to programmatically poll for a successful authorization grant.
Detects anomalous, rapid registration of rogue devices following a device-code authentication flow. The rule identifies instances where an 'unbound' device registration is immediately followed by a 'bound' call to obtain Azure AD and Microsoft Graph tokens, or where a Primary Refresh Token (PRT) is acquired shortly after a device-code sign-in, indicating potential abuse of the device authorization grant flow by an attacker using phishing kits.
Detects a successful user authentication event following a Microsoft OAuth 2.0 device authorization grant flow. This detection identifies scenarios where a user may have been phished into entering an attacker-supplied device code on a malicious Microsoft device login page, resulting in the attacker successfully obtaining OAuth tokens.
Detects a suspected device code phishing (GhostCode) attack where a user authenticates via a device code flow, followed within 10 minutes by a non-interactive authentication request originating from a client utilizing the 'python-requests' user agent. This pattern is indicative of an adversary abusing a stolen device token to gain access to cloud resources.
Page 39 of 80