Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
NTLM Relay Attempt
YARA-L
Detects NTLM successful network logons where the source and destination workstations are the same, excluding loopback addresses. This behavior can be indicative of NTLM relay attacks where an attacker relays authentication from a victim to the victim's own machine, or other forms of NTLM abuse.
The analytic detects successful Remote Desktop Protocol (RDP) login sessions, identified by Windows Security Event ID 4624 with Logon Type 10. This indicates a user has successfully authenticated and established an interactive RDP session, which is a critical indicator of remote access to a Windows system. Correlating this with Event ID 1149 (RDP authentication success) helps differentiate between credential acceptance and actual session establishment.
Detects when a user's phone authentication method is changed or added, followed shortly by a successful MFA-based sign-in for that same user. This pattern can indicate a SIM swap attack where an adversary socially engineers a helpdesk or convinces a mobile carrier to port a user's number to an adversary-controlled SIM card. This allows the adversary to intercept MFA codes sent via SMS or phone call and gain unauthorized access.
This rule detects a sequence of successful Azure AD sign-ins from the same user and device. The first sign-in uses a refresh token (RT) for a non-interactive user session, specifically for the Microsoft Teams desktop client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e) from an Azure AD joined device, where the token protection status is 'unbound'. This is followed by a second successful sign-in using a primary refresh token (PRT) from the same user and device, excluding sign-ins to the 'Device Registration Service'. This sequence could indicate an adversary attempting to transition from an acquired refresh token to a primary refresh token, potentially to gain broader access or persistence within the Azure AD environment.
Detects successful Okta authentication using the FIDO/WebAuthn cross-device (hybrid) sign-in feature. This technique is abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns, like those conducted by PoisonSeed, to bypass FIDO MFA by tricking a user into scanning a malicious QR code.
Detects successful user authentication using the FIDO2/WebAuthn cross-device (hybrid) sign-in feature. This technique can be abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns to bypass FIDO key protections, as seen in the PoisonSeed campaign.
Detects the successful registration of a new FIDO2/WebAuthn security key for a user account. This activity can be legitimate, but attackers who have compromised an account may register their own FIDO key to maintain persistent access. This activity should be correlated with other suspicious events, such as a recent password reset or login from an unusual location.
This detection identifies instances where the ESXi UI is accessed using the root account from an external IP address. Direct root access to the UI bypasses role-based access controls and auditing practices, and may indicate risky behavior, misconfiguration, or unauthorized activity by a malicious actor using compromised credentials.
Detects Microsoft Entra ID sign-in events where a user principal authenticates using a refresh token issued to the Microsoft Authentication Broker (MAB) client, targeting the Device Registration Service (DRS) with the "adrs_access" OAuth scope. This pattern may indicate token-based access to DRS following an initial authorization code phishing or as a precursor to malicious device registration using tools like ROADtx.
This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Sentinel KQL Detection for ShadowHound
KQL Query
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitor Privilege User SSPR
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: NEW Real-time Anomalous Token Detection
Page 72 of 80