Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
This rule identifies potentially malicious Azure AD/Entra authentication flows by flagging interruptions during MFA (e.g., failure codes 50074, 50140 indicating MFA requirements or time-outs during suspected AiTM phishing attempts) and the usage of Device Code Grant flows, which are frequently abused by adversaries to bypass MFA and capture session tokens.
Detects a multi-stage cloud attack sequence involving a sign-in anomaly, modification of user authentication methods (e.g., registering an attacker-controlled device), reconnaissance using Microsoft Graph API, and subsequent abnormal data access/download, typically observed in Storm-3121 and Storm-3032 activities.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
Detects the addition of a new Multi-Factor Authentication (MFA) method for a user account shortly after a suspicious or risky login attempt (e.g., unfamiliar features, risk states, or unusual network locations). This pattern is consistent with an adversary attempting to establish persistent access by registering their own MFA device to a compromised account.
Detects a sequence of events where a user performs a sign-in from an unmanaged or mobile device while interacting with applications often associated with MFA or SSO prompts (indicative of a social engineering lure), followed by an administrative update to register a new authentication method within 30 minutes. This pattern is characteristic of attackers establishing persistent access to an account by adding their own MFA device.
Detects anomalous usage of the OAuth 2.0 Device Authorization Grant flow (Device Code Flow). This flow is frequently abused by attackers to bypass MFA by tricking users into authenticating an attacker-controlled device or session, potentially leading to token theft or unauthorized access to sensitive enterprise applications.
Detects anomalous reuse of an authenticated Microsoft 365 session cookie shortly after a successful MFA-satisfied sign-in. The detection identifies scenarios where the subsequent access originates from a different IP address, device, or user agent without an intervening MFA challenge, which is a pattern indicative of session hijacking techniques like Adversary-in-the-Middle (AiTM) or session token replay.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects successful sign-ins where Multi-Factor Authentication (MFA) was approved using the 'PhoneAppOTP' method, specifically where the method was registered by the user prior to the observed sign-in timeframe. This pattern can indicate an adversary using an actor-controlled MFA device registered previously to maintain persistent access to a compromised account.
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects instances where a user authenticates via the device code flow and subsequently performs a device enrollment or registration action from an unusual or non-compliant device naming convention. This pattern is indicative of an adversary enrolling their own device to bypass MFA or gain persistent access to corporate resources.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Page 11 of 22