Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
256 detections
Filters
Last updated
All Time
Detection languages
105
48
37
29
21
Contributors
95
44
35
17
11
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
160
128
78
7
7
Products / Services
144
123
42
33
30
MITRE Techniques
152
104
90
82
80
IDS Classtypes
3
IDS Protocols
3
Detects specific authentication failure codes (50074, 50140) associated with MFA bypass and session persistence interruptions, which are characteristic of Adversary-in-the-Middle (AiTM) phishing attacks targeting modern authentication flows.
This rule detects the addition of new multi-factor authentication (MFA) methods to an Azure AD or Entra ID user account. Adversaries often register new MFA methods (such as phone numbers or authenticator apps) to accounts they have compromised, enabling them to bypass existing MFA requirements and maintain persistent access to the target environment.
Detects when a user identity in Azure AD has a new software OTP token activated, specifically marked with property flags indicating a placeholder or new device enrollment. This behavior can be indicative of an adversary registering a new, attacker-controlled MFA device to maintain persistent access to a compromised account.
Detects a sequence of user activities—authentication, MFA registration, Graph API reconnaissance, and data exfiltration—originating from a rotating set of distinct source IP addresses for the same user within a 24-hour period. This behavior is indicative of coordinated infrastructure rotation tactics used by threat actors in cloud intrusions.
Detects high-risk account modifications, such as adding MFA methods or OAuth consent grants, occurring shortly after a user sign-in. This pattern is indicative of post-AiTM session theft (e.g., NovaCookies) where an adversary uses a stolen session token to modify account settings for persistence or MFA bypass.
This rule identifies potential MFA fatigue attacks by detecting multiple MFA denial or failure events for a user within a 30-minute window, followed by a successful authentication for the same user in the same time frame.
Detects changes to user authentication methods, such as activating software tokens, registering new security information, or changing MFA configuration. This activity can indicate an adversary attempting to modify MFA settings to maintain persistent access or bypass account security controls.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
Detects high-risk account modifications, such as adding MFA methods or OAuth consent grants, occurring shortly after a user sign-in. This pattern is indicative of post-AiTM session theft (e.g., NovaCookies) where an adversary uses a stolen session token to modify account settings for persistence or MFA bypass.
This rule detects when a user account updates their MFA information in Azure AD or Microsoft 365, resulting in an increase in the number of associated MFA devices. This is a common indicator of an attacker registering a new MFA device (such as a hardware token or phone app) to a compromised account to establish persistence or bypass existing MFA requirements.
Detects multiple failed multifactor authentication (MFA) attempts from the same user on an unmanaged device. This behavior is indicative of an adversary attempting to bypass MFA or perform MFA fatigue attacks using stolen credentials.
Detects modifications to a user's Azure Active Directory (Entra ID) account involving the addition of a new MFA authentication method or device, such as software tokens or mobile devices. This activity is often performed by an adversary to establish persistence by registering a device they control for future authentication bypass.
Detects signs of Adversary-in-the-Middle (AiTM) phishing kits by identifying sequential, rapid-fire attempts to authenticate using multiple distinct MFA methods (such as push notifications, TOTP codes, or SMS) within a single sign-in session. These attempts are combined with explicit failure states (rejected passwords, rejected codes, or denied MFA requests), suggesting an attacker is relaying authentication challenges in real-time to a victim.
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects signs of Adversary-in-the-Middle (AiTM) phishing kits by identifying sequential, rapid-fire attempts to authenticate using multiple distinct MFA methods (such as push notifications, TOTP codes, or SMS) within a single sign-in session. These attempts are combined with explicit failure states (rejected passwords, rejected codes, or denied MFA requests), suggesting an attacker is relaying authentication challenges in real-time to a victim.
Detects high-risk account modifications, such as adding MFA methods or OAuth consent grants, occurring shortly after a user sign-in. This pattern is indicative of post-AiTM session theft (e.g., NovaCookies) where an adversary uses a stolen session token to modify account settings for persistence or MFA bypass.
Page 7 of 13