Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects potential MFA bypass attempts by identifying multiple successful sign-ins from the same user within an hour where Conditional Access policies were not applied, and no MFA method was used. This could indicate an adversary circumventing security controls to gain unauthorized access.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
This rule detects an unusual pattern of multiple login attempts from several unique devices using Windows Hello for Business within a short timeframe (5 minutes) for a single user. This could indicate an MFA bypass attempt or a compromised account where an adversary is attempting to gain access from various devices.
This rule detects potential multi-factor authentication (MFA) bypass attempts for privileged accounts. It identifies instances where an administrative user attempts 10 or more sign-ins from 3 or more unique devices within a 5-minute window, specifically when the authentication method is 'Push notification to app' and the result type is '0' (success). This behavior could indicate an adversary attempting to bypass MFA for a privileged account.
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects suspicious command-line activity related to Duo Security administration. It looks for processes executing with 'duo_client', 'duo_admin', or 'duo_api' in their command line, combined with sensitive parameters like '--admin-api', '--key', '--secret', or 'token'. The rule specifically excludes processes spawned by 'powershell.exe' or 'cmd.exe' to reduce noise, and triggers if such activity occurs at least twice within an hour on the same computer by the same user. This could indicate an attempt to manipulate Duo Security configurations, potentially to bypass multi-factor authentication.
This rule detects suspicious command-line activity related to Duo Security administration. It looks for processes executing with 'duo_client', 'duo_admin', or 'duo_api' in their command line, combined with sensitive parameters like '--admin-api', '--key', '--secret', or 'token'. The rule specifically excludes processes spawned by 'powershell.exe' or 'cmd.exe' to reduce noise, and triggers if such activity occurs at least twice within an hour on the same computer by the same user. This could indicate an attempt to manipulate Duo Security configurations, potentially to bypass multi-factor authentication.
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged and non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.
This rule detects multiple failed sign-in attempts using the 'Device Code' authentication flow from various IP addresses or locations for a single user. This behavior can indicate an adversary attempting to bypass multi-factor authentication (MFA) or gain unauthorized access through device code phishing or brute-force attacks against the device code flow. The rule specifically looks for more than 3 attempts from more than 2 distinct IP addresses or locations, targeting common Microsoft applications like Office, Teams, Azure Portal, or Graph.
This rule detects potential MFA bypass attempts by identifying multiple successful sign-ins from the same user within an hour where Conditional Access policies were not applied, and no MFA method was used. This could indicate an adversary circumventing security controls to gain unauthorized access.
This rule detects an unusual pattern of multiple login attempts from several unique devices using Windows Hello for Business within a short timeframe (5 minutes) for a single user. This could indicate an MFA bypass attempt or a compromised account where an adversary is attempting to gain access from various devices.
This rule detects potential multi-factor authentication (MFA) bypass attempts for privileged accounts. It identifies instances where an administrative user attempts 10 or more sign-ins from 3 or more unique devices within a 5-minute window, specifically when the authentication method is 'Push notification to app' and the result type is '0' (success). This behavior could indicate an adversary attempting to bypass MFA for a privileged account.
This rule detects potential MFA bypass attempts using Evilginx by looking for HTTP POST requests to the server that contain both 'session' and 'token' in the URI, with a body size greater than 100 bytes. This pattern is indicative of session token capture, a technique used by Evilginx to bypass multi-factor authentication.
This rule detects attempts to register a new device for MFA bypass persistence by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'authentication/methods'. This activity could indicate an attacker attempting to register their own device as a trusted device to bypass multi-factor authentication in an Office 365 environment.
Detects successful Microsoft Entra ID sign-ins where the user agent indicates a Node.js-based HTTP client (e.g., node, axios, undici, node-fetch). Tycoon 2FA and other AiTM phishing kits heavily leverage these backend automated tools for token relay and renewal immediately following MFA interception.
This rule detects a suspicious sequence of events in Okta that could indicate a help-desk social engineering attack or account takeover. Specifically, it looks for a user's password being reset, followed by the enrollment of a new MFA factor or device for that same user, all occurring within a short time frame (1 hour) and potentially from distinct session IDs or device hashes. This pattern suggests an attacker has gained initial access (e.g., via social engineering the help desk) and is immediately attempting to establish persistence by enrolling their own MFA device.
This rule detects HTTP requests that appear to be credential phishing attempts, specifically looking for pages that might also attempt to bypass multi-factor authentication (MFA). It triggers when an HTTP URI contains the keywords "token", "verify", and "auth" (case-insensitive). This combination of keywords in the URI suggests a page designed to collect credentials and potentially an MFA bypass token.
Detects successful interactive device-code flow sign-ins through the Microsoft Authentication Broker application (Client ID 29d9ed98-a469-4536-ade2-f981bc1d605e). Tycoon 2FA operators frequently abuse this specific flow to bypass multi-factor authentication and steal session tokens.
This rule detects attempts to modify or delete Multi-Factor Authentication (MFA) provider configurations via the Microsoft Graph API. Specifically, it looks for HTTP DELETE requests to 'graph.microsoft.com' with a URI containing 'authentication'. This activity could indicate an attacker attempting to disable or alter MFA settings to gain unauthorized access or maintain persistence.
Page 18 of 22