Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
256 detections
Filters
Last updated
All Time
Detection languages
105
48
37
29
21
Contributors
95
44
35
17
11
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
160
128
78
7
7
Products / Services
144
123
42
33
30
MITRE Techniques
152
104
90
82
80
IDS Classtypes
3
IDS Protocols
3
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Surfaces Silverfort-detected incidents excluding ImpossibleTravel (high FP rate from VPN and mobile users, better covered by XSIAM Analytics UEBA)
Detects signs of Adversary-in-the-Middle (AiTM) phishing kits by identifying sequential, rapid-fire attempts to authenticate using multiple distinct MFA methods (such as push notifications, TOTP codes, or SMS) within a single sign-in session. These attempts are combined with explicit failure states (rejected passwords, rejected codes, or denied MFA requests), suggesting an attacker is relaying authentication challenges in real-time to a victim.
Correlates Microsoft Entra identity risk detections with subsequent password changes, MFA registrations, and security information modifications. Helps identify potential account compromise scenarios where authentication methods or credentials are altered after suspicious sign-in activity.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Detects a user registering a new MFA or authentication method within a short window after multiple failed Entra ID sign-in attempts, without a corresponding verified helpdesk password-reset ticket. This pattern is indicative of vishing or helpdesk-impersonation attacks aimed at hijacking user accounts by circumventing MFA controls.
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Detects user account lockouts or instances where a user has been flagged for frequent failed authentication attempts within the Duo Security platform. This activity is indicative of brute force attacks, credential stuffing, or attempts to bypass Multi-Factor Authentication (MFA) via fatigue or repeated request generation.
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
Detects MFA authentication attempts in Duo where the source IP address is identified by Duo as a known anonymous proxy, VPN, or Tor exit node. Such infrastructure is frequently used by adversaries to mask their true origin during credential stuffing, session hijacking, or post-compromise activity.
This rule detects instances where a user has explicitly marked an MFA push notification as fraudulent within the Duo Security platform. This indicates that an unauthorized party may have triggered an MFA request using stolen credentials, and the legitimate user is actively denying the authentication attempt.
This rule detects the generation of 2-Step Verification (2SV) backup/scratch codes in Google Workspace. Backup codes allow a user to bypass standard MFA, making their generation a significant security event that may indicate an attacker is attempting to maintain persistent access to an account, often following a compromise or as a preparation for further malicious activity.
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
Duo MFA Push Fatigue Activity
Cortex XDR
Detects a suspicious burst of multi-factor authentication (MFA) push request denials (such as user cancellations or ignored requests) originating from a single user within a short time window. This behavior is indicative of MFA fatigue, where an attacker repeatedly triggers MFA requests in an attempt to annoy or trick the legitimate user into inadvertently approving a push notification.
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
Detects a near-simultaneous correlation between a user registering a new FIDO2 authentication method and a login session from an unmanaged or non-compliant device. This behavioral pattern is often associated with adversary-in-the-middle or vishing attacks where an attacker tricks a user into registering an attacker-controlled security key to maintain persistent MFA access.
Detects the registration of a new FIDO2 security key or passkey in Entra ID that is associated with a sign-in from an unmanaged or non-compliant device shortly before or after the registration. This behavior often suggests a vishing or social engineering scenario where an attacker guides a user through an authentication method registration process while impersonating IT support.
Detects a sequence of authentication events from a specific IP address associated with the Microsoft Authentication Broker app, where an initial MFA challenge (ResultType 50199 - MFA challenge) is followed by a successful authentication (ResultType 0). This pattern is indicative of MFA fatigue attacks where an adversary repeatedly prompts a user until they inadvertently approve the request.
Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.
Page 8 of 13