Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,417
11,806
5,870
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
Detects an authentication event followed by a computer account change event (Event ID 4742) targeting a domain controller computer account. This pattern may indicate unauthorized modifications to domain controller machine accounts, which is often associated with persistence or privilege escalation attempts.
Detects user creation, capability granting, or role modification events occurring on WordPress sites where the Admin Menu Editor plugin (versions 2.35 or 2.36) is active and the associated user account has administrator privileges. This pattern is often indicative of exploitation of known vulnerabilities in this specific plugin to perform unauthorized administrative actions.
Detects the addition of a new Multi-Factor Authentication (MFA) method for a user account shortly after a suspicious or risky login attempt (e.g., unfamiliar features, risk states, or unusual network locations). This pattern is consistent with an adversary attempting to establish persistent access by registering their own MFA device to a compromised account.
Detects a sequence of events where a user performs a sign-in from an unmanaged or mobile device while interacting with applications often associated with MFA or SSO prompts (indicative of a social engineering lure), followed by an administrative update to register a new authentication method within 30 minutes. This pattern is characteristic of attackers establishing persistent access to an account by adding their own MFA device.
This rule detects the addition of new multi-factor authentication (MFA) methods to an Azure AD or Entra ID user account. Adversaries often register new MFA methods (such as phone numbers or authenticator apps) to accounts they have compromised, enabling them to bypass existing MFA requirements and maintain persistent access to the target environment.
Detects when a user identity in Azure AD has a new software OTP token activated, specifically marked with property flags indicating a placeholder or new device enrollment. This behavior can be indicative of an adversary registering a new, attacker-controlled MFA device to maintain persistent access to a compromised account.
Detects high-risk account modifications, such as adding MFA methods or OAuth consent grants, occurring shortly after a user sign-in. This pattern is indicative of post-AiTM session theft (e.g., NovaCookies) where an adversary uses a stolen session token to modify account settings for persistence or MFA bypass.
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
Detects changes to user authentication methods, such as activating software tokens, registering new security information, or changing MFA configuration. This activity can indicate an adversary attempting to modify MFA settings to maintain persistent access or bypass account security controls.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
This rule monitors for security-related account activities in Azure AD, specifically tracking self-service password resets, admin-led password resets, and changes to user security information. It aggregates these events by user to identify potential account manipulation, unauthorized password changes, or MFA registration abuse.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
KQL Query from file: postgresql-replication-account-escalated-to-superuser-cve-2026-6471.kql
This detection identifies enabled user accounts that have not had a successful sign-in for the last 90 days, highlighting potential security risks from dormant accounts.
Detects the creation of new AWS access keys or login profiles for a target identity immediately following the deletion or modification of a credential for the same identity, where the actors performing the two actions are different. This pattern indicates an adversary creating persistent access after a security incident responder or automated system has revoked a previously compromised credential.
Detects high-risk account modifications, such as adding MFA methods or OAuth consent grants, occurring shortly after a user sign-in. This pattern is indicative of post-AiTM session theft (e.g., NovaCookies) where an adversary uses a stolen session token to modify account settings for persistence or MFA bypass.
Detects modifications to a user's multi-factor authentication (MFA) settings, including changes to registered phone numbers, authenticator app configurations, or the registration of new authentication methods. This activity can indicate an attempt to weaken security defenses or gain persistent, unauthorized access to an account via MFA bypass.
Page 12 of 29