Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
1,075
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,396
11,792
5,863
5,144
4,864
1,664
Platforms
1,089
590
440
252
122
Products / Services
1,128
476
189
125
116
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects non-interactive OAuth2 token refresh attempts targeting Microsoft 365 services where the authentication is satisfied by a pre-existing session without MFA challenge. The rule flags instances where the sign-in originates from an IP address with a different ASN or country than the user's previous interactive session and uses specific browser user-agents identified in known Adversary-in-the-Middle (AiTM) campaigns like the Payroll Pirate.
Detects the use of the RoadTx tool to perform a Resource Owner Password Credential (ROPC) grant against Microsoft Graph while bypassing MFA. This behavior leverages CVE-2025-0309 by abusing hidden Conditional Access exclusions for specific client IDs, resulting in an authentication token issued without an MFA claim.
This rule detects anomalous sign-in attempts to VPN or SSO services by identifying deviations from a user's established baseline of device and location combinations. It flags sign-ins where there are at least two anomalies (new country, new ASN, new device ID, new user agent), or specific critical combinations like a new country and new device, or an unmanaged device signing in from a new country or ASN. This pattern is consistent with adversaries using stolen credentials, potentially from infostealer logs, to access enterprise resources.
Detects a sequence of events indicative of a successful phishing attack: a user receives an email containing a suspected phishing URL, clicks the URL, and subsequently performs a successful sign-in from an IP address not seen in their recent 14-day history within 15 minutes of the click.
Detects real-time Multi-Factor Authentication (MFA) OTP relay, commonly associated with Adversary-in-the-Middle (AitM) phishing frameworks like Bluekit. The rule flags successful sign-ins where MFA methods (SMS, TOTP, or Authenticator app) are completed with an abnormally low latency (under 10 seconds), suggesting automated relay, or where discrepancies exist in session context indicative of proxy-based interception.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
This rule detects successful self-service password reset (SSPR) operations performed by users from IP addresses geolocated to a country that does not match their typical sign-in activity over the past 30 days. This behavior may indicate account takeover where an adversary has compromised credentials and is resetting the password to maintain access or gain further persistence.
This rule detects successful sign-ins using the OAuth 2.0 Device Code Flow. This flow is often abused in phishing attacks (device code phishing) where an attacker tricks a user into authenticating a malicious application. A successful sign-in using this method could indicate a compromised account or a successful phishing attempt.
Detects successful logon events (4624) or special logon attempts (4648) associated with accounts or workstations identified as Qualys scanner agents. This is typically used to identify or baseline vulnerability scanning activity across the environment.
Detects NTLM network logons (LogonType 3) where the workstation name does not match the target computer name and is not a machine account. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash or other credential relay attacks, where an adversary authenticates to a remote system using compromised credentials.
Detects Kerberos Authentication Service Requests (AS-REQ) resulting in a ticket granting ticket (TGT) where the TicketOptions field is set to '0x40810010'. This specific combination is often associated with the behavior of tools performing Kerberoasting or specific types of ticket-based attacks, as it indicates a TGT request that may bypass standard pre-authentication or follow non-standard flow patterns.
Detects modifications to a computer account (Event ID 4742) that involve the addition or modification of Service Principal Names (SPNs) containing sensitive strings such as 'GC/' (Global Catalog), 'DRS' (Directory Replication Service), or specific GUIDs. These activities are often associated with techniques to facilitate Kerberoasting, domain trust exploitation, or unauthorized service manipulation.
Detects Kerberos Authentication Service Requests (AS-REQ) resulting in a ticket granting ticket (TGT) where the TicketOptions field is set to '0x40810010'. This specific combination is often associated with the behavior of tools performing Kerberoasting or specific types of ticket-based attacks, as it indicates a TGT request that may bypass standard pre-authentication or follow non-standard flow patterns.
Detects successful user sign-ins from a country that has not been observed in the user's sign-in activity over the past 30 days. This baseline helps identify potentially compromised accounts by surfacing geographic anomalies.
This rule detects potential token theft or MFA bypass by correlating successful MFA-satisfied interactive sign-ins with subsequent non-interactive sign-ins (token refreshes) occurring within a 60-minute window from different IP addresses for the same user. This pattern is indicative of an attacker stealing a session token (e.g., via session cookie theft or AiTM phishing) and using it to authenticate from a different location.
Detects instances where a user successfully authenticates using Multi-Factor Authentication (MFA) from one location, followed by a Single-Factor Authentication (SFA) logon from a different location within a 10-minute window. This behavior is indicative of potential session hijacking or session cookie theft where an attacker reuses an authenticated session or manipulates the authentication flow to bypass MFA requirements.
This rule identifies potential session hijacking or session replay attacks by detecting successful logins from the same user account using the same User-Agent string but originating from different source IP addresses within a one-hour window. This behavior is indicative of an attacker replaying stolen session cookies, effectively bypassing Multi-Factor Authentication (MFA) requirements associated with initial authentication.
Detects anomalous AWS API activity immediately following a successful ConsoleLogin event for the same user. This behavior is indicative of a session replay attack, often associated with AiTM phishing kits like PoisonSeeds, where a victim's session cookie is harvested and immediately reused by an attacker to programmatically access the AWS environment.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
This rule detects potentially compromised accounts by correlating successful device code authentication events that exhibit anomalous characteristics (such as first-time usage, high/medium risk scores, or non-compliant/unmanaged device status) with highly sensitive Azure AD/Graph API administrative operations occurring within 30 minutes of the sign-in.
Detects successful sign-ins using legacy authentication protocols (e.g., IMAP, POP3, SMTP AUTH, ROPC) for user accounts that are in scope of a Conditional Access policy requiring multi-factor authentication (MFA). Legacy protocols do not support modern authentication flows, effectively bypassing configured MFA requirements and increasing the risk of credential-based attacks.
Page 57 of 80