Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
Detects modifications to a user's multi-factor authentication (MFA) settings, including changes to registered phone numbers, authenticator app configurations, or the registration of new authentication methods. This activity can indicate an attempt to weaken security defenses or gain persistent, unauthorized access to an account via MFA bypass.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Detects signs of Adversary-in-the-Middle (AiTM) phishing kits by identifying sequential, rapid-fire attempts to authenticate using multiple distinct MFA methods (such as push notifications, TOTP codes, or SMS) within a single sign-in session. These attempts are combined with explicit failure states (rejected passwords, rejected codes, or denied MFA requests), suggesting an attacker is relaying authentication challenges in real-time to a victim.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous reuse of an authenticated Microsoft 365 session cookie shortly after a successful MFA-satisfied sign-in. The detection identifies scenarios where the subsequent access originates from a different IP address, device, or user agent without an intervening MFA challenge, which is a pattern indicative of session hijacking techniques like Adversary-in-the-Middle (AiTM) or session token replay.
Detects signs of Adversary-in-the-Middle (AiTM) phishing kits by identifying sequential, rapid-fire attempts to authenticate using multiple distinct MFA methods (such as push notifications, TOTP codes, or SMS) within a single sign-in session. These attempts are combined with explicit failure states (rejected passwords, rejected codes, or denied MFA requests), suggesting an attacker is relaying authentication challenges in real-time to a victim.
Page 12 of 22