Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
93
25
23
19
11
Contributors
98
20
18
9
5
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
134
60
56
24
6
Products / Services
94
57
57
24
12
MITRE Techniques
103
56
55
31
30
IDS Classtypes
1
1
IDS Protocols
3
KQL Query
This rule detects potential session token replay attacks in Azure Active Directory by correlating interactive or single-factor sign-in events using 'python-requests' user agents (common in automated tooling) with subsequent 'Register device' and 'Register security info' (Windows Hello for Business) activity within a 48-hour window. This behavior often indicates an adversary attempting to register a device to a compromised account to maintain persistence or bypass MFA requirements.
KQL Query
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
This rule monitors Okta system logs for lifecycle events related to inbound Identity Providers (IdP), specifically creation, modification, activation, deactivation, or deletion. It flags these changes when initiated by clients identified as proxies or associated with known abused ASNs. This activity is indicative of potential cross-tenant impersonation where an attacker with administrative access adds a malicious IdP to federate and impersonate organizational users.
Detects successful non-interactive sign-ins to Azure CLI using the Resource Owner Password Credentials (ROPC) flow where Conditional Access policies failed to enforce multi-factor authentication (MFA). This typically indicates misconfigured Conditional Access policies, such as exclusions for non-interactive authentication methods or service accounts, which could be exploited by adversaries to bypass MFA.
Detects Entra ID sign-in failures with error code AADSTS500172, indicating that a federated SAML assertion was rejected due to invalid or stale token-signing material. This may indicate an attempt to use a forged or recovered SAML token (e.g., Golden SAML) where the signing key is no longer valid or recognized.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects Active Directory Federation Services (ADFS) token issuance or claims processing events (Event IDs 299, 1200-1203) that lack a corresponding preceding primary authentication audit event within the same correlation instance. This lack of correlation suggests the SAML assertion was not initiated by a legitimate login, potentially indicating the use of a forged SAML token (Golden SAML attack).
This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.
Detects a sequence of events within a 30-minute window for a single user, specifically capturing MFA configuration changes (reset/enrollment), authentication, and device registration, occurring outside of typical business hours (20:00 - 06:00). This behavioral pattern is often indicative of an adversary establishing persistence or account takeover after gaining access to a valid account.
Detects when a new federated identity credential is successfully added to an Azure Active Directory (Entra ID) application. This activity is a common method for attackers to establish persistent access to cloud resources by bypassing password-based authentication.
Detects when a new federated identity credential is successfully added to an Azure Active Directory (Entra ID) application. This activity is a common method for attackers to establish persistent access to cloud resources by bypassing password-based authentication.
Detects the use of the AADInternals PowerShell module for suspicious device registration activities, such as phantom device creation and Primary Refresh Token (PRT) manipulation, which are common techniques used to bypass Conditional Access policies. The rule correlates PowerShell command execution containing AADInternals cmdlets with subsequent Azure AD device registration events originating from the same host within a 15-minute window.
Detects a sequence of events within a 30-minute window for a single user, specifically capturing MFA configuration changes (reset/enrollment), authentication, and device registration, occurring outside of typical business hours (20:00 - 06:00). This behavioral pattern is often indicative of an adversary establishing persistence or account takeover after gaining access to a valid account.
Detects modifications to Azure AD domain federation settings or authentication methods that could indicate attempts to establish persistent access or bypass authentication controls (e.g., golden SAML attacks, domain-level backdoors). The rule monitors for successful operations related to domain federation, authentication changes, and domain management, excluding known administrative actions from internal Microsoft domains.
Detects modifications to Azure AD domain federation settings or authentication methods that could indicate attempts to establish persistent access or bypass authentication controls (e.g., golden SAML attacks, domain-level backdoors). The rule monitors for successful operations related to domain federation, authentication changes, and domain management, excluding known administrative actions from internal Microsoft domains.
Detects modifications to Azure AD domain federation settings or authentication methods that could indicate attempts to establish persistent access or bypass authentication controls (e.g., golden SAML attacks, domain-level backdoors). The rule monitors for successful operations related to domain federation, authentication changes, and domain management, excluding known administrative actions from internal Microsoft domains.
Detects instances where a GitHub Actions runner requests an OIDC token and subsequently executes an npm publish command within 5 minutes. This behavior is indicative of unauthorized package deployment, potentially exploiting GitHub's OIDC 'trusted publishing' mechanism, as observed in the Miasma worm campaign.
Detects anomalous Primary Refresh Token (PRT) issuance for non-compliant, non-hybrid joined devices that do not utilize TPM attestation, followed by immediate access to high-value Microsoft resources like Microsoft Graph, Exchange, or SharePoint. This activity is indicative of the Storm-2372 Conditional Access bypass technique, where attackers register 'phantom' devices to circumvent security policies.
Page 7 of 9