Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
Detects successful non-interactive sign-ins to Azure CLI using the Resource Owner Password Credentials (ROPC) flow where Conditional Access policies failed to enforce multi-factor authentication (MFA). This typically indicates misconfigured Conditional Access policies, such as exclusions for non-interactive authentication methods or service accounts, which could be exploited by adversaries to bypass MFA.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Detects non-interactive sign-ins to Microsoft 365 using the OAuth Resource Owner Password Credentials (ROPC) flow via the Azure CLI. This legacy authentication method enables attackers to bypass multi-factor authentication (MFA) by submitting credentials directly to the authentication endpoint, a technique observed in password spraying campaigns.
Detects high-frequency MFA factor updates, resets, activations, deactivations, or deletions for a single user within a 30-minute window. This behavior often indicates an adversary attempting to compromise or take control of account authentication mechanisms after gaining initial access.
This rule detects the exploitation of CVE-2026-48558, a critical OIDC authentication bypass vulnerability in SimpleHelp. The detection logic correlates log events for 'Registering technician login' involving 'New Anon' sessions with subsequent configuration save requests occurring within 30 seconds. This pattern signifies the unauthorized creation of a privileged technician account by an unauthenticated attacker, bypassing standard identity verification.
Detects high-frequency MFA factor updates, resets, activations, deactivations, or deletions for a single user within a 30-minute window. This behavior often indicates an adversary attempting to compromise or take control of account authentication mechanisms after gaining initial access.
Detects Microsoft 365 sign-in patterns indicative of an adversary bypassing Conditional Access device compliance requirements using an edge appliance proxy. The rule identifies successful authentication sessions from non-compliant or unmanaged devices that satisfy Conditional Access, often involving impossible travel or multiple source IPs, suggesting the use of an intermediary infrastructure to masquerade as a trusted location.
Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.
Detects evidence of CVE-2026-48558 exploitation, where SimpleHelp servers fail to cryptographically verify OIDC tokens. This vulnerability allows unauthenticated attackers to create privileged technician accounts and bypass Multi-Factor Authentication (MFA). The rule monitors for 'New Anon' log tags in OIDC authentication flows or unauthorized HTTP POST requests to SimpleHelp technician management endpoints.
Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects network requests to Microsoft Graph API that appear to be modifying authentication methods, specifically targeting phone-based multi-factor authentication settings. This may indicate an adversary attempting to register their own MFA device to a compromised account to maintain persistence or bypass MFA.
Detects the exploitation of a vulnerability in the SimpleHelp OIDC authentication flow where an attacker can register a forged technician account and self-register MFA during the first login, effectively bypassing mandatory multi-factor authentication requirements. The detection looks for specific sequences in server logs involving OIDC attribute fetching and 'New Anon' technician registration tags.
Detects a suspicious pattern where a user successfully authenticates via MFA, followed by another successful sign-in attempt for the same account within 10 minutes using a different IP address or user agent. This behavior is often indicative of session hijacking or adversary-in-the-middle (AiTM) attacks where a session token is stolen and replayed from an attacker-controlled environment.
Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.
Detects enumeration of Entra ID (Azure AD) users, groups, devices, and service principals using the Microsoft Graph API, specifically when performed by tools like AzureHound or Roadtx. The detection focuses on activity originating from sign-ins that bypassed MFA, potentially leveraging a hidden CA policy scope exclusion (CVE-2025-0309). The rule identifies suspicious user agents and a high volume of requests to multiple Graph API enumeration endpoints.
Detects potential Microsoft 365 session token replay attacks, often associated with Adversary-in-the-Middle (AiTM) kits. The rule identifies suspicious sign-in activity originating from proxy or anonymized IP addresses where MFA was bypassed or incomplete, coupled with a geographic location that deviates from the user's established 30-day baseline or constitutes a new, unseen location.
This rule detects the exploitation of CVE-2026-48558 in SimpleHelp, where an OIDC authentication bypass allows unauthenticated attackers to forge identity tokens. The lack of cryptographic signature verification permits the registration of unauthorized, privileged Technician accounts, effectively bypassing MFA. The detection logic monitors for specific log patterns indicating OIDC response processing followed by technician account registration and configuration changes.
This rule detects network activity indicating a potential modification or interaction with Microsoft Entra ID (Azure AD) multifactor authentication (MFA) settings. Specifically, it looks for POST requests to the Microsoft Graph API targeting authentication methods (e.g., phoneAuthenticationMethod), which may be indicative of an attacker modifying MFA settings to bypass security controls or register rogue authentication devices.
Detects high volumes of sign-in failures or instances where Conditional Access policies are not applied, particularly for unregistered devices, indicating potential attempts to bypass security controls or perform brute-force attacks against cloud authentication.
Page 14 of 22