Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Azure AD Device Code Flow Token Phishing
Cortex XDR
Detects potential device code phishing attacks by identifying OAuth token requests associated with the device code flow that originate from unmanaged or non-compliant devices. The rule specifically monitors for suspicious Cmsi (Client Managed Service Identity) activity or the use of unbound sign-in tokens within the device code flow for targeted Microsoft productivity and management applications.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects sign-in activity originating from a known suspicious VPN/proxy IP range targeting critical Microsoft 365 applications. The rule specifically monitors for instances where multi-factor authentication (MFA) enforcement appears to be absent or failed, suggesting a potential account compromise and subsequent data access attempt via a proxy/VPN.
This rule detects potentially malicious reuse of an existing Entra ID (Azure AD) refresh or session token (via UniqueTokenIdentifier) across multiple, distinct device IDs, IP addresses, or user-agent strings within a short period (default 4 hours). It specifically flags instances where the authentication was completed via a non-interactive token claim, suggesting the adversary is bypassing MFA by hijacking an active session.
Detects a suspicious pattern where a user authenticates to a remote access portal (like Citrix or VPN) without multi-factor authentication (MFA) or with an existing risk flag, followed by a surge in file activity (creation, modification, or renaming of >500 files or >200 distinct files) on the same account within a 24-hour window, potentially indicating compromised credential usage for staging data for exfiltration or ransomware.
Detects successful authentication events to Snowflake cloud data warehouse platforms where no secondary authentication factor (MFA) was registered or triggered. This pattern is indicative of potential credential stuffing or reuse attacks, particularly those involving stolen credentials from infostealer malware, where MFA was not configured or successfully bypassed.
Detects modifications to Azure AD/Entra ID security configurations that lower the security posture, specifically the disabling of Security Defaults, per-user MFA requirements, or strong authentication enforcement. This is often a precursor to account takeover or persistence following unauthorized administrative access.
Correlates an Entra ID MFA/authenticator reset with a new device registration within 30 minutes for the same account. Models the Scattered Spider (UNC3944/Octo Tempest) and CrowdStrike-tracked 'Mutant Spider' helpdesk-vishing playbook, where Mandiant's M-Trends 2026 measured ~40 minutes from vished reset to domain admin.
Detects an anomalous OfficeHome sign-in from an unmanaged device that completes secondary auth (error 50074) followed by a keep-me-signed-in event (error 50140), with the same session/user then rapidly accessing multiple sensitive applications (My Apps, My Profile, Account Controls, My SignIns, SharePoint/OneDrive/Outlook) - consistent with AiTM-assisted MFA bypass and persistent session establishment
Device code authentication flow completed, followed by subsequent session activity from a different IP/user-agent, indicating token replay to an attacker-controlled client that bypasses MFA
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects a suspicious pattern where a user authenticates to a remote access portal (like Citrix or VPN) without multi-factor authentication (MFA) or with an existing risk flag, followed by a surge in file activity (creation, modification, or renaming of >500 files or >200 distinct files) on the same account within a 24-hour window, potentially indicating compromised credential usage for staging data for exfiltration or ransomware.
Detects instances where a user account registers a new MFA security method shortly after an initial successful sign-in from an unfamiliar device or network (Autonomous System Number). This behavioral pattern is characteristic of attackers, such as ShinyHunters vishing operators, who gain initial access via compromised credentials and subsequently enroll their own MFA devices to establish persistent access.
Detects potential MFA push fatigue (bombing) attacks by identifying users who receive an abnormal frequency of MFA push notification denials or interruptions within a short window, followed immediately by a successful authentication on a previously unseen device fingerprint. This pattern is characteristic of attackers attempting to wear down users into approving unauthorized login requests.
Detects instances where an administrative, helpdesk, or support account registers or updates security info (such as MFA methods) for a user, specifically when this action is preceded by a password reset for that same user. This pattern is indicative of account takeover attempts, particularly those involving vishing-based social engineering of helpdesk staff to bypass MFA.
Detects unauthorized modifications to Microsoft Entra Conditional Access (CA) policies, including deleting policies, disabling them, removing MFA requirements, or excluding specific users. These actions are common techniques used by adversaries to establish persistence or facilitate unauthorized access by weakening security controls.
This rule detects scenarios where an existing SSO or Identity Provider (IdP) session is reused from a device context that differs from the one that originally performed MFA. It identifies this by joining authentication events by SessionId, specifically looking for instances where MFA occurred in one event and a subsequent non-MFA event for the same session has a different User-Agent, DeviceId, JA3 hash, or Operating System build, indicating potential session token theft or reuse.
Page 1 of 22