Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Detects anomalous Primary Refresh Token (PRT) issuance for non-compliant, non-hybrid joined devices that do not utilize TPM attestation, followed by immediate access to high-value Microsoft resources like Microsoft Graph, Exchange, or SharePoint. This activity is indicative of the Storm-2372 Conditional Access bypass technique, where attackers register 'phantom' devices to circumvent security policies.
Detects NTLM network logons (LogonType 3) where the workstation name does not match the target computer name and is not a machine account. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash or other credential relay attacks, where an adversary authenticates to a remote system using compromised credentials.
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
Detects successful authentications where a Temporary Access Pass (TAP) was used as the primary authentication method. TAPs bypass standard password and MFA requirements, and their usage outside of expected scenarios (like onboarding or account recovery) could indicate an adversary bypassing authentication mechanisms.
This rule detects EvilTokens device code OAuth phishing by identifying rapid, repeated POST requests to the /common/oauth2/token endpoint with a device_code grant and authorization_pending responses, followed by a successful token issuance and sign-in without an MFA claim. This pattern is consistent with EvilTokens session harvesting.
Detects potential Pass-the-Hash lateral movement where a single account uses NTLM authentication as a local administrator to access three or more distinct devices within a 30-minute window, a pattern often indicative of automated credential propagation.
Detects successful user sign-ins from a country that has not been observed in the user's sign-in activity over the past 30 days. This baseline helps identify potentially compromised accounts by surfacing geographic anomalies.
Detects successful non-interactive token acquisitions using specific Microsoft first-party application IDs known to bypass Entra Conditional Access Policies through Nested App Authentication (NAA/BroCI). The detection specifically targets sign-ins to the Microsoft Graph resource.
This rule monitors for successful external logins occurring on an endpoint that previously demonstrated patterns of suspected MFA fatigue (multiple failed push notifications) and subsequent internal reconnaissance activity (execution of commands used for domain or system discovery). The rule correlates these events to identify potential compromised credentials being actively used for lateral movement or persistence.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
Correlates a successful AAD sign-in from a new IP address immediately followed by the registration of a new FIDO2 or Authenticator device, a hallmark of AiTM persistence.
Detects successful device code authentication via the Microsoft Office App (FOCI), which could indicate potential Adversary-in-the-Middle (AiTM) phishing attacks. The rule specifically looks for successful sign-ins using the 'deviceCode' authentication protocol and the AppId associated with Microsoft Office.
Identifies successful device code authentication followed by a high volume of file downloads within a short timeframe, which could indicate data exfiltration after an adversary has gained access through a device code phishing campaign.
Identifies logins from geographically distant locations occurring faster than physically possible, highlighting proxy infrastructure. This KQL query analyzes Google Workspace login success events, grouping them by account and a 10-minute time window. It then filters for instances where an account has successfully logged in from two or more distinct locations within that short timeframe, indicating potential impossible travel.
SSL VPN password spray ending in success
Cortex XDR
This rule targets high-volume account failures followed by a successful tunnel or portal authentication on SSL VPNs. It aims to detect password spraying attacks that eventually lead to a successful login, providing causality fields for investigation.
This rule identifies a suspicious sequence of events: a successful device code authentication immediately followed (within one hour) by a device registration event (PRT upgrade) for the same user. This pattern is indicative of a device code phishing attack where an attacker tricks a user into authenticating a device code, then registers their own device to gain persistent access.
Detects successful sign-ins utilizing the device code flow, which is frequently abused in Adversary-in-the-Middle (AiTM) phishing attacks. This rule specifically looks for successful authentication events where the 'AuthenticationProtocol' is 'deviceCode'.
Identifies Azure Active Directory (AAD) logins from new or unusual locations followed immediately by the creation of inbox rules designed to delete incoming emails. This behavior is indicative of an attacker gaining access to an email account and attempting to disrupt communication or hide their activities by automatically deleting legitimate emails.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
Page 62 of 80