Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
256 detections
Filters
Last updated
All Time
Detection languages
105
48
37
29
21
Contributors
95
44
35
17
11
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
160
128
78
7
7
Products / Services
144
123
42
33
30
MITRE Techniques
152
104
90
82
80
IDS Classtypes
3
IDS Protocols
3
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects MFA fatigue attacks where a user receives more than 10 MFA push denials within a 10-minute window, followed immediately by a successful authentication from a different IP address. This behavior is indicative of an adversary bombarding a user with push notifications until they are approved, followed by account takeover.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.
Detects an SSPR (Self-Service Password Reset) event immediately followed by the registration of a new Microsoft Authenticator method for the same user. This sequence of events can indicate an attacker has compromised an identity, performed a password reset, and is attempting to establish a new MFA method for persistent access.
This rule detects a sequence of events where multiple failed one-time code (MFA) attempts are followed by a successful new device registration within Dashlane. This pattern can indicate an attacker attempting to brute-force MFA codes and then registering a new device once successful, potentially leading to account compromise.
This rule detects a sequence of events where multiple failed one-time code (MFA) attempts are followed by a successful new device registration within Dashlane. This pattern can indicate an attacker attempting to brute-force MFA codes and then registering a new device once successful, potentially leading to account compromise.
Details: Detection for MFA fatigue attacks where a high number of MFA push denies in a short period are followed by a successful sign-in attempt.
Hypothesis: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.
Recommended Actions: Review sign-in logs for user around time of alert and contact them directly to confirm/verify activity.
Hypothesis: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.
Recommended Actions: Review sign-in logs for user around time of alert and contact them directly to confirm/verify activity.
Okta MFA Push Bombing / Fatigue
Cortex XDR
Detects repeated push denials for the same user within a short timeframe, indicating an active MFA fatigue attack where an adversary is attempting to overwhelm a user with MFA requests in hopes they will eventually approve one.
This rule detects a potential MFA SMS code request flooding attack. It triggers when a single source IP address makes 10 or more HTTP requests containing the string "send_code" in the URI within a 60-second window. This behavior is indicative of an attacker repeatedly attempting to request MFA codes, likely in an attempt to overwhelm the user or the system, or to facilitate a SIM-swapping attack.
Detects potential multi-factor authentication (MFA) fatigue attacks in Azure AD by identifying a high number of push notification MFA challenges for a single user from a specific IP address within a short time frame. Specifically, it looks for 15 or more push notification MFA challenges within a 30-minute window.
Detects potential multi-factor authentication (MFA) fatigue attacks in Azure AD by identifying a high number of push notification MFA challenges for a single user from a specific IP address within a short time frame. Specifically, it looks for 15 or more push notification MFA challenges within a 30-minute window.
This rule detects automated multi-factor authentication (MFA) push bombing attempts targeting Duo Security's API. It specifically looks for HTTP POST requests to 'api.duosecurity.com' and triggers an alert if 10 such requests are observed from the same source IP within a 30-second window. This behavior is indicative of an attacker repeatedly sending MFA push notifications to a user's device in an attempt to overwhelm them or trick them into approving a fraudulent login.
This rule detects a potential MFA fatigue attack by monitoring repeated HTTP requests to known MFA provider domains (duo.com, okta.com, microsoft.com) containing the string "auth" in the URI. A threshold of 20 requests within 60 seconds from the same destination IP address triggers the alert, indicating an attacker might be repeatedly sending push notifications to a user's device to overwhelm them into accepting an authentication request.
This rule detects a suspicious sequence of events in Okta that could indicate a help-desk social engineering attack or account takeover. Specifically, it looks for a user's password being reset, followed by the enrollment of a new MFA factor or device for that same user, all occurring within a short time frame (1 hour) and potentially from distinct session IDs or device hashes. This pattern suggests an attacker has gained initial access (e.g., via social engineering the help desk) and is immediately attempting to establish persistence by enrolling their own MFA device.
This rule detects suspicious multi-factor authentication (MFA) behavior by identifying MFA denials that occur from an unknown IP address or with an unusual authentication method for a given user. It establishes a baseline of known IP addresses and usual authentication methods for each user over a 30-day period. Alerts are generated for recent MFA denials (within the last hour) if they involve a high-risk denial detail (e.g., too many invalid codes, user blocked) combined with an unknown IP or unusual authentication method, or if they involve any other denial reason combined with both an unknown IP and an unusual authentication method. This helps to identify potential MFA fatigue attacks or attempts to bypass MFA.
Detects Okta Multi-Factor Authentication (MFA) factor enrollment, activation, update, and reset events. These events may indicate an attacker adding their own MFA factor post-compromise to maintain access or removing an existing factor to weaken account security and facilitate unauthorized access.
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.
Detects multiple multi-factor authentication (MFA) attempts that are denied or ignored by a user beyond a defined threshold within a specific lookback window. This behavior is indicative of an MFA fatigue attack, where an adversary repeatedly sends MFA requests to a user in hopes they will eventually approve one to stop the annoyance.
Page 10 of 13