Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,401
11,795
5,864
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
Detects a successful self-service password reset followed shortly by an authentication method change on the same account -- the exact SSPR-then-MFA-reregistration sequence used by Storm-3068 and Storm-2949 for persistence.
Hardened before submission: switched TargetResources[0] positional indexing to mv-expand + type == "User" matching, consistent with the fix already applied to the Agent User group-membership rule.
MITRE ATT&CK: T1098.005 (Account Manipulation: Device Registration), T1556 (Modify Authentication Process)
Hardened before submission: switched TargetResources[0] positional indexing to mv-expand + type == "User" matching, consistent with the fix already applied to the Agent User group-membership rule.
MITRE ATT&CK: T1098.005 (Account Manipulation: Device Registration), T1556 (Modify Authentication Process)
Correlates an Entra ID MFA/authenticator reset with a new device registration within 30 minutes for the same account. Models the Scattered Spider (UNC3944/Octo Tempest) and CrowdStrike-tracked 'Mutant Spider' helpdesk-vishing playbook, where Mandiant's M-Trends 2026 measured ~40 minutes from vished reset to domain admin.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects instances where a user account registers a new MFA security method shortly after an initial successful sign-in from an unfamiliar device or network (Autonomous System Number). This behavioral pattern is characteristic of attackers, such as ShinyHunters vishing operators, who gain initial access via compromised credentials and subsequently enroll their own MFA devices to establish persistent access.
Detects instances where an administrative, helpdesk, or support account registers or updates security info (such as MFA methods) for a user, specifically when this action is preceded by a password reset for that same user. This pattern is indicative of account takeover attempts, particularly those involving vishing-based social engineering of helpdesk staff to bypass MFA.
Detects high-risk operations performed by the Entra ID/AAD Connect synchronization service account (e.g., Sync_* or ADToAADSyncServiceAccount). This account, which often holds broad directory permissions, is a prime target for attackers to gain persistence or escalate privileges within the cloud directory. The rule monitors for unauthorized sign-ins, sensitive configuration changes (such as modifications to federation trust, authentication policies, or directory synchronization settings), and password resets targeting the sync account itself.
This rule detects when a new password credential (client secret) is added to an existing Azure AD Service Principal or application. This activity is a common method for adversaries to establish persistence in a cloud environment that survives password resets or MFA enforcement on the original administrative account.
Detects when a user registers a new multi-factor authentication (MFA) method, such as an authenticator app, phone number, or FIDO key, within 30 minutes of a sign-in event flagged as anomalous (e.g., impossible travel, new ASN, or risky sign-in score). This pattern is indicative of an adversary establishing persistence by registering their own MFA device to maintain access to a compromised account after a session hijack.
Detects MFA or security information registration, updates, or deletions within Entra ID AuditLogs that occur within two hours of a sign-in event flagged as risky, impossible travel, or involving a new device. This sequence is a common indicator of post-compromise identity persistence.
Detects administrative IAM operations such as user, role, or access key creation performed by an identity containing 'agent' in its ARN or username. This behavior is intended to flag unauthorized privilege escalation or persistence mechanisms initiated by automated service identities that should not be modifying IAM configurations.
Detects a sequence of events indicative of an account takeover (ATO) attack, starting with a help-desk initiated password reset, followed immediately by new MFA factor or device enrollment, and concluding with an application login from an unrecognized device or location.
Detects account modification activity (e.g., password resets or MFA registration changes) followed within 24 hours by a sign-in event for the same user account that is flagged as risky or exhibits anomalous device/location characteristics, indicative of social engineering campaigns like Scattered Spider.
Detects registration of a new actor-controlled MFA authentication method (phone, authenticator app, or software OTP token) via an Update user operation, matching the NO_DEVICE/NO_DEVICE_TOKEN/SoftwareTokenActivated pattern used to convert temporary compromise into durable identity persistence
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.
Detect when a user creates a new DACL in AD for their own AD object.
Detects the creation of scheduled tasks, recurring jobs, or webhook subscriptions by a user identity flagged as an AI_AGENT. This activity is monitored for persistence, especially when the event lacks a descriptive context or targets external networks, suggesting potential unauthorized agent behavioral drift or malicious persistence.
Detects potential account takeover by monitoring identity providers (Azure AD or Okta) for MFA method resets or deletions immediately followed by new MFA method registrations for the same user. This behavior is highly characteristic of Scattered Spider's (Octo Tempest) tactic of social-engineering help-desk staff to perform MFA resets, allowing the adversary to enroll their own device to bypass MFA and maintain persistence.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects the registration of a new authentication method (e.g., FIDO2 key, authenticator app) shortly after a user account experiences a risky sign-in event. This pattern is indicative of an adversary attempting to establish persistent access and bypass MFA requirements, often following a successful AiTM (Adversary-in-the-Middle) phishing attack.
Detects the disabling of the built-in 'Administrator' account initiated by a system-level process (e.g., service or background task), which is characteristic of GPO enforcement or malicious tampering.
Page 3 of 29