Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
93
25
23
19
11
Contributors
98
20
18
9
5
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
134
60
56
24
6
Products / Services
94
57
57
24
12
MITRE Techniques
103
56
55
31
30
IDS Classtypes
1
1
IDS Protocols
3
Detects the granting of tenant-wide admin consent for 'openid' and 'profile' scopes to 'AllPrincipals' within an Azure environment. This activity is indicative of the final stage in a TrustSink or similar rogue External Authentication Method (EAM) attack, where an adversary configures an application to bypass user consent prompts for sensitive identity scopes.
Detects the creation of an application registered with a specific Microsoft external authentication provider URI, immediately followed by the configuration of its service principal with reply URLs pointing to external tunneling services like ngrok. This sequence is indicative of an attacker attempting to register a rogue MFA provider to intercept authentication requests.
Correlates an MFA method change with the next sign-in occurring from an ASN/country never seen for that user in 30 days, operationalizing TrustSphere's 2026 finding that reset-then-new-location access is the clearest signal separating a hijack from a genuine recovery.
Detects modifications to Microsoft Entra authentication policy or external authentication method configurations, which may indicate an adversary attempting to establish a 'TrustSink' or alternate authentication persistence mechanism by registering a malicious OIDC provider or modifying authentication policy.
This rule detects persistence by identifying accounts that continue to authenticate using an External Authentication Method (EAM) both before and after a password reset event. This behavior suggests that an adversary has established a persistent authentication mechanism (such as an EAM) that survives a standard password reset, indicating potential account compromise and bypass of primary authentication controls.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
Detects non-interactive sign-in activity using a Primary Refresh Token (PRT) occurring shortly after a risky or AiTM-flagged interactive sign-in for the same user, originating from a device that has not been previously associated with that user account.
Detects modifications to domain federation settings or the addition of new identity providers in Entra ID occurring within 24 hours of a risky sign-in event by the same user account. This behavior is indicative of a persistence mechanism involving MFA bypass via federated authentication, often referred to as a 'Golden SAML' or 'Federated Identity Backdoor' technique.
This rule detects a correlation between high-risk or anomaly-flagged sign-ins and subsequent changes to B2B guest invitation or tenant collaboration policies by the same user account within a 30-minute window. This behavior is indicative of an adversary who has successfully hijacked a session (e.g., via AiTM or token replay) and is attempting to establish persistence or pivot by inviting external accounts or modifying B2B security settings.
Detects successful Azure AD sign-in events where the session is marked as compliant or trusted by Conditional Access policies, but simultaneously flagged by Identity Protection as originating from an anonymized IP (e.g., residential proxy, VPN). This indicates an adversary has bypassed location-based Conditional Access controls, likely in the context of an Adversary-in-the-Middle (AiTM) phishing attack.
Detects SAML token authentication events where the token-signing certificate does not match the established federation baseline (indicating potential token forging or unauthorized IdP activity) or where critical conditional access claims (MFA and device compliance) are missing from the SAML assertion.
Detects the addition or modification of federated domain trusts or identity provider settings within Entra ID. Such actions can be indicative of attackers establishing persistent access or implementing Golden SAML-style attacks by forging authentication assertions via a compromised or malicious identity trust.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects successful Azure AD sign-in events where the session is marked as compliant or trusted by Conditional Access policies, but simultaneously flagged by Identity Protection as originating from an anonymized IP (e.g., residential proxy, VPN). This indicates an adversary has bypassed location-based Conditional Access controls, likely in the context of an Adversary-in-the-Middle (AiTM) phishing attack.
Detects anomalous activity where a user performs a device-code authentication followed rapidly by a device registration event and the subsequent issuance of a Primary Refresh Token (PRT) or x-ms-RefreshTokenCredential. This pattern is often indicative of OAuth device-authorization flow abuse, where an adversary attempts to register a malicious device to gain persistent access.
Detects anomalous device registration behavior where a user account registers multiple unique devices within a very short timeframe (less than 90 seconds). This behavior is characteristic of device code phishing attacks, where an adversary uses automated scripts to rapidly register devices after obtaining authorization codes from victims.
Detects authentication failures in Microsoft Entra ID associated with external MFA providers. This condition, specifically indicated by failure codes 70002 or 50012 and associated error messages regarding signature validation or external token trust, may indicate an attempt to bypass authentication via a rogue MFA provider or a misconfigured integration.
Detects signs of the TrustSink technique where an Entra sign-in process, while at the MFA stage, is intercepted by redirecting the user to a rogue External Authentication Method (EAM) provider. This unauthorized provider typically uses look-alike domains or tunneling services to host phishing pages that harvest plaintext credentials and return forged MFA tokens to Entra.
Page 5 of 9