Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,401
11,795
5,864
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
Detects instances where a risky Azure AD sign-in (e.g., token replay or confirmed compromise) is closely followed (within 24 hours) by sensitive application or service principal credential modifications by the same user account. This behavior is indicative of potential persistence establishment via account manipulation.
Detects the addition of new credentials (certificates, secrets, or keys) to Azure AD Service Principals or Applications, occurring outside of standard business hours (6 AM to 8 PM). This pattern is often indicative of an adversary establishing or maintaining persistent access to an enterprise cloud environment.
Detects the addition of new credentials (certificates, secrets, or keys) to Azure AD Service Principals or Applications, occurring outside of standard business hours (6 AM to 8 PM). This pattern is often indicative of an adversary establishing or maintaining persistent access to an enterprise cloud environment.
Detects a cluster of Windows Event IDs 4740 (Account Lockout) or 4724 (Password Reset) targeting the local 'Administrator' account across multiple hosts within a short time window. This activity is indicative of automated or mass account manipulation often associated with ransomware payloads or centralized GPO-based credential tampering.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Flags MFA method deletions performed by an actor other than the account owner, especially when followed by registration of a new authenticator — the signature of a helpdesk agent socially engineered into swapping a victim's MFA factor.
Sequence detection for the three-step chain — credential reset, MFA/authenticator reset, new device registration — completing within 40 minutes for one user, directly modeling the Scattered Spider/UNC3944 speed-to-domain-admin playbook from Mandiant M-Trends 2026.
Flags FIDO2/passkey registrations initiated or facilitated by a helpdesk/support identity for another user's account, matching Okta's advisory on threat actor O-UNC-066 ('Pink' leak site) and the ShinyHunters O-UNC-037 campaign that mimicked Microsoft's passkey enrollment flow to register attacker-controlled passkeys.
Flags Global Administrator / Privileged Role Administrator role grants occurring within one hour of a password/MFA reset or TAP issuance on the same account — the terminal step of a completed helpdesk-vishing takeover.
Detects when a user adds a new Multi-Factor Authentication (MFA) method such as a phone number, authenticator app, or FIDO2 key in Entra ID (Azure AD). Attackers often register their own MFA devices to maintain persistent access to a compromised account, particularly following a successful password reset or social engineering event.
Detects a suspicious sequence of events: an anomalous login (new device, new location, or high-risk sign-in) followed by the assumption of a highly privileged role (via AssumeRole, PIM, or role elevation) and subsequent sensitive administrative actions (e.g., creating access keys, modifying IAM policies, or disabling security auditing). This pattern is indicative of cloud identity compromise and privilege escalation, commonly seen in attacks involving groups like Scattered Spider.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Detects potential vishing or account takeover precursor activity where an external or guest Microsoft Teams user, impersonating IT or Help Desk support, communicates with a user who subsequently modifies their credentials or MFA configuration within the same 24-hour period.
Detects high-risk administrative actions in Entra ID, such as role assignments, user creation, or password resets, occurring shortly after a user authenticates using the device code flow. This pattern is indicative of a post-compromise takeover where an adversary utilizes a stolen or coerced device code session to escalate privileges.
Detects high-privilege account management actions in Entra ID (password resets or MFA modifications) performed by service or admin accounts, which are characteristic of social engineering (vishing) attacks targeting IT helpdesks to gain unauthorized access.
Detects instances where an administrative user performs a password or MFA method reset on a target account, followed within 24 hours by a sign-in event from that same target account flagged with a high or medium risk level. This sequence is characteristic of Adversary-in-the-Middle (AiTM) attacks, where an attacker utilizes stolen session tokens and subsequently coerces helpdesk or administrative intervention to reset MFA requirements to maintain unauthorized access.
This rule detects potential account compromise by identifying scenarios where a user's security information (MFA methods) is modified, deleted, or updated, followed shortly after (within 24 hours) by a successful sign-in using a less secure authentication method (SMS, Voice, OATH, or Mobile App notification) instead of a stronger method like FIDO2 or Passkey.
Detects suspicious post-exploitation activities, including service creation, local account modification, or security tool tampering, executed as SYSTEM shortly after activity associated with the ADSelfService Plus GINA logon-screen vulnerability (CVE-2026-74849).
Detects signs of Zerologon (CVE-2020-1472) exploitation by correlating Netlogon (MS-NRPC) authentication anomalies involving known exploitation tools/process names with subsequent machine-account password reset events (Event ID 4742) occurring on the same device within a short time window.
Detects potential persistence establishment in M365 environments following anomalous or risky sign-in events. This pattern is characteristic of Adversary-in-the-Middle (AiTM) attacks where a session cookie is stolen, followed by immediate adversary actions to secure long-term access, such as MFA method registration, OAuth app consent, or mailbox rule configuration.
This rule detects a correlation between a successful user login from an IP address not previously seen for that specific user in the last 14 days, followed immediately (within 1 hour) by sensitive administrative operations performed by the same user, such as adding members to roles or modifying application permissions.
Page 6 of 29