Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
Detects successful authentication attempts using legacy (basic) protocols that do not enforce modern Conditional Access policies (e.g., MFA, device compliance). The rule specifically flags these events if the originating IP address or geographic location is not observed in historical sign-in activity for the specific user, which may indicate account compromise via credential theft.
Detects successful authentication attempts using legacy (basic) protocols that do not enforce modern Conditional Access policies (e.g., MFA, device compliance). The rule specifically flags these events if the originating IP address or geographic location is not observed in historical sign-in activity for the specific user, which may indicate account compromise via credential theft.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
This rule detects administrative changes that weaken cloud identity security, specifically the disabling of Entra ID Security Defaults, per-user MFA enforcement, or tenant-wide authentication-methods policies. These actions remove critical second-factor authentication requirements, significantly increasing the risk of unauthorized access via password-spraying or credential-stuffing attacks.
Detects successful authentication attempts using legacy (basic) protocols that do not enforce modern Conditional Access policies (e.g., MFA, device compliance). The rule specifically flags these events if the originating IP address or geographic location is not observed in historical sign-in activity for the specific user, which may indicate account compromise via credential theft.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects successful sign-in events in Entra ID where MFA is marked as satisfied, but no interactive MFA challenge (e.g., Push, FIDO2, SMS) was recorded as completed in the authentication details. This behavior, when correlated with a new IP, device, or user-agent relative to a 30-day baseline, is highly indicative of session token replay or AitM (Adversary-in-the-Middle) attacks attempting to bypass MFA requirements.
Detects instances where a user account that has been flagged as risky (e.g., unfamiliar features, impossible travel, or malicious IP activity) performs a modification or registration of multi-factor authentication (MFA) security information within a short timeframe (30 minutes). This behavior is highly indicative of an adversary attempting to establish persistence or bypass authentication controls after a credential compromise.
Detects instances where a user account performs non-interactive or legacy authentication (e.g., IMAP, POP3, SMTP, ActiveSync) shortly after an endpoint associated with that same user is flagged for malware or infostealer activity. This pattern is indicative of an adversary using exfiltrated credentials to maintain access to cloud services while bypassing MFA policies.
Detects non-interactive sign-in events in Entra ID that occur without a preceding interactive sign-in session on the same device that successfully satisfied a multi-factor authentication (MFA) challenge. This behavior is indicative of token replay attacks or session hijacking where an adversary attempts to use harvested session cookies or tokens to access resources.
This rule detects potential session hijacking by monitoring for the reuse of session or refresh tokens from unrecognized devices, browsers, or user agents, particularly when such activity occurs without an interactive MFA challenge. This behavior is indicative of an attacker attempting to use stolen session cookies or tokens to access cloud resources.
Detects the reuse of session tokens from distinct network locations, devices, or user agents shortly after a successful MFA-protected login. This behavioral pattern is a primary indicator of Adversary-in-the-Middle (AiTM) phishing, where attackers capture session tokens via reverse proxy to bypass authentication controls.
Detects potential Adversary-in-the-Middle (AiTM) MFA bypass attacks (quishing). The rule correlates receipt of an email containing an image attachment (potential QR code) but no URL, followed by a risky mobile sign-in event from a device that is unmanaged or lacks trust within a two-hour window.
Detects instances where a user account triggers a risky sign-in event (flagged by identity protection) and subsequently uses the same session or token to authenticate successfully from a different network location or IP address within two hours. This behavior suggests that a malicious actor may be leveraging a compromised session token that should have been revoked, potentially indicating a failure of continuous access evaluation or token revocation mechanisms.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects repeated, silent authentication events in Microsoft 365 where MFA challenges are absent, consistent with the use of stolen session or refresh tokens (e.g., EvilTokens) to maintain persistent, unauthorized access to user accounts.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Flags MFA method deletions performed by an actor other than the account owner, especially when followed by registration of a new authenticator — the signature of a helpdesk agent socially engineered into swapping a victim's MFA factor.
Page 4 of 22