Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,424
11,812
5,870
5,145
4,864
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
Detects authentication failures in Microsoft Entra ID associated with external MFA providers. This condition, specifically indicated by failure codes 70002 or 50012 and associated error messages regarding signature validation or external token trust, may indicate an attempt to bypass authentication via a rogue MFA provider or a misconfigured integration.
Detects signs of the TrustSink technique where an Entra sign-in process, while at the MFA stage, is intercepted by redirecting the user to a rogue External Authentication Method (EAM) provider. This unauthorized provider typically uses look-alike domains or tunneling services to host phishing pages that harvest plaintext credentials and return forged MFA tokens to Entra.
Detects Microsoft Entra ID sign-in events where the multi-factor authentication (MFA) requirement was marked as satisfied by an External Authentication Method (EAM) provider, but the authentication claims (AMR) include values typically reserved for locally verified hardware-based factors (e.g., hwk, fido). This pattern is indicative of a TrustSink attack, where a malicious OIDC identity provider injects forged assertions to bypass actual MFA requirements.
Detects successful authentication events that rely on external authentication method providers, which may indicate an adversary is using a rogue MFA provider to bypass standard authentication controls or to perform adversary-in-the-middle (AiTM) attacks.
Detects Azure AD sign-in events where Multi-Factor Authentication (MFA) was reportedly satisfied by an External Authentication Method (EAM) claim without evidence of a traditional secondary authentication challenge. This behavior is indicative of a 'TrustSink' technique where a rogue or compromised OIDC provider injects a spoofed assertion of MFA success into the authentication token.
Detects Microsoft Entra ID sign-in events where the multi-factor authentication (MFA) requirement was marked as satisfied by an External Authentication Method (EAM) provider, but the authentication claims (AMR) include values typically reserved for locally verified hardware-based factors (e.g., hwk, fido). This pattern is indicative of a TrustSink attack, where a malicious OIDC identity provider injects forged assertions to bypass actual MFA requirements.
Detects successful authentication events that rely on external authentication method providers, which may indicate an adversary is using a rogue MFA provider to bypass standard authentication controls or to perform adversary-in-the-middle (AiTM) attacks.
Detects Azure AD sign-in events where Multi-Factor Authentication (MFA) was reportedly satisfied by an External Authentication Method (EAM) claim without evidence of a traditional secondary authentication challenge. This behavior is indicative of a 'TrustSink' technique where a rogue or compromised OIDC provider injects a spoofed assertion of MFA success into the authentication token.
Detects successful Entra ID sign-in events that utilize an External Authentication Method (EAM) within 7 days of that authentication method being registered or modified in the tenant's authentication methods policy. This pattern is indicative of a potential MFA bypass scenario where an adversary registers a rogue external authentication provider to intercept or forge MFA tokens.
Detects sign-in events where Multi-Factor Authentication (MFA) was satisfied using an External Authentication Method (EAM) that asserts specific possession or inherence claims (e.g., 'hwk' - hardware key). This behavior may indicate an adversary attempting to bypass or forge MFA responses via a rogue EAM provider.
Detects sign-in events where Multi-Factor Authentication (MFA) was satisfied using an External Authentication Method (EAM) that asserts specific possession or inherence claims (e.g., 'hwk' - hardware key). This behavior may indicate an adversary attempting to bypass or forge MFA responses via a rogue EAM provider.
This rule monitors for ADFS-related security events that may indicate credential theft or authentication bypass attempts. It flags anomalous federated sign-in events (e.g., MFA bypass, unfamiliar location), unauthorized access to the ADFS DKM container in Active Directory, and suspicious attempts to export ADFS token-signing certificates.
This rule detects anomalous behavior where a single user account registers multiple devices within a very short timeframe (80 seconds). This pattern often follows the theft of a device code or OAuth authorization token, where an adversary attempts to rapidly enroll multiple rogue devices to maintain persistent access or bypass MFA controls.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects successful modifications to user MFA methods (StrongAuthenticationMethod) where the associated device details are missing or indicate a software-only token activation. This behavior is often indicative of an adversary adding their own MFA device to a compromised account to maintain persistent access or bypass MFA requirements.
Detects potential Adversary-in-the-Middle (AitM) activity where a user triggers both a standard MFA requirement (50074) and a subsequent MFA requirement within the same session (50140), potentially indicating the user is interacting with a proxy site that requires re-authentication or session interception. The rule specifically looks for users who trigger these events in short succession, often associated with phishing campaigns aiming to bypass MFA.
Detects anomalous sign-in activity where a user triggers both Error Code 50074 (MFA required) and 50140 (MFA bypass occurred or not required/invalidated) in a short window of time (less than 1 hour). The rule looks for sessions on unmanaged devices (empty TrustType) using Chrome, which may indicate an adversary attempting to bypass or manipulate MFA enrollment or verification flows.
Detects unauthorized cloud authentication attempts in Azure AD where a session token appears to have been replayed. The rule identifies sign-ins flagged by Identity Protection as anomalous or involving token/issuer irregularities, particularly when these occur without a fresh MFA challenge, suggesting a bypass of standard authentication controls.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
Page 10 of 22