Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects a suspicious sequence of administrative actions where a user's phishing-resistant multi-factor authentication (MFA) factor, such as FIDO2, passkeys, or certificates, is removed and immediately replaced by a weaker authentication method like SMS, voice call, or TOTP. This behavior, when performed by an administrator account on a different user account, is a common indicator of an MFA bypass attempt often associated with social engineering or insider threat scenarios.
Detects modifications to Entra ID Conditional Access or Okta authentication policies that introduce MFA exclusions, trusted network bypasses, or authentication-strength downgrades. This activity is highly indicative of an adversary attempting to maintain persistence or bypass MFA following a successful initial account compromise.
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
This rule detects successful user logins utilizing the OAuth 2.0 device authorization grant flow where Multi-Factor Authentication (MFA) was bypassed, not applied, or not performed. The device code flow is a common vector for phishing attacks where users are tricked into entering a device code on a malicious site, potentially leading to unauthorized token acquisition.
Detects modifications to Active Directory user accounts (Event IDs 4720, 4738) that coincide with suspicious MFA registration indicators—such as increased device counts, software token activations, or default device/token placeholders—within one hour of a successful user authentication event. This behavior is indicative of potential account takeover or persistence activities involving MFA manipulation.
Detects a suspicious authentication pattern involving 3 or more MFA failures within 15 minutes, immediately followed by an MFA success for the same user. This pattern is characteristic of potential Adversary-in-the-Middle (AiTM) activity, where an attacker intercepts a session or MFA token and relays it through separate infrastructure, while the legitimate user's own MFA attempts fail or time out.
Detects instances where a user account registers the PhoneAppOTP MFA method and subsequently performs a successful authentication using that method within a defined window, followed by authentication attempts originating from non-browser, likely automated, UserAgents (e.g., node, python, axios). This pattern may indicate an adversary who has registered their own MFA device to gain persistent, automated access to the account.
This rule detects inbound phishing emails that leverage urgent security themes (e.g., passkey, SSO, or MFA updates) to lure users into clicking links. It correlates these emails with subsequent URL clicks and suspicious sign-in activity, such as MFA failures, which are indicative of an attempt to compromise credentials or bypass MFA.
Detects modifications to a user account's authentication methods, specifically when an increase in the number of configured multi-factor authentication (MFA) devices or methods occurs. This is often associated with an adversary enrolling their own device to bypass MFA or maintain persistent access.
Detects successful Azure AD sign-in events where the session is marked as compliant or trusted by Conditional Access policies, but simultaneously flagged by Identity Protection as originating from an anonymized IP (e.g., residential proxy, VPN). This indicates an adversary has bypassed location-based Conditional Access controls, likely in the context of an Adversary-in-the-Middle (AiTM) phishing attack.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Detects modifications to Entra ID (Azure AD) Conditional Access policies where a user or group is explicitly added to an exclusion list. This behavior can be used by adversaries to bypass mandatory Multi-Factor Authentication (MFA) or device compliance requirements, facilitating persistence on a compromised account.
Detects a suspicious pattern where a user account experiences a burst of multiple MFA failures followed by an anomalous successful authentication within a short 15-minute window. This behavior is indicative of automated MFA fatigue attacks or attempts to exploit MFA bypass vulnerabilities.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
This rule monitors authentication events for the 'deviceCode' protocol where multi-factor authentication (MFA) was not required or completed. This is a common indicator of device code phishing attacks, where an adversary lures a user into authorizing a malicious device or application, often bypassing organizational MFA policies.
Detects anomalous, non-interactive Microsoft 365 sign-in events where an authentication session bypasses MFA via a previously issued token claim or device-code flow, indicative of ARToken or similar session hijacking and token replay attacks.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by monitoring specific Azure AD sign-in failure codes (50074: strong authentication is required, 50140: interruption of sign-in) in conjunction with logins from unmanaged devices.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Page 9 of 22