Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,401
11,795
5,864
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
Detects a sequence of events where a user performs a device-code authentication followed rapidly by a device enrollment, and subsequently continues to access cloud services (Microsoft Graph, Exchange Online, Intune) shortly after their account password has been reset. This pattern is indicative of persistent access maintained via a registered device or OAuth token that survives credential remediation.
Detects the enrollment of a new security key or passkey shortly after an unfamiliar or suspicious sign-in event within Google Workspace. This behavior is indicative of an adversary establishing persistent access following a successful session hijack or credential phishing campaign, specifically targeting authentication mechanisms to bypass existing security controls.
Detects instances where a suspicious login event (such as a risk challenge) is immediately followed by a credential or recovery information modification. This pattern may indicate an adversary is attempting to take over a compromised account by resetting the password or recovery details after triggering a security alert.
Detects MFA method resets, security info updates, or new authentication device registrations targeting privileged or administrator accounts in Azure AD/Entra ID audit logs. This activity is often indicative of social engineering campaigns, including AI-driven voice or video deepfake impersonation of employees contacting helpdesk support to gain unauthorized account access.
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
Detects high-velocity administrative activity performed by a single user account in Azure Active Directory, specifically focusing on account provisioning and role membership changes. The rule flags patterns such as password resets, enabling/disabling accounts, adding new users, and privilege escalation (e.g., granting Global Administrator roles), which are indicative of malicious post-compromise activity.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Detects a suspicious sequence of events indicative of social engineering. An administrator or help-desk account resets a user's password, followed within 15 minutes by the target user performing a successful MFA authentication from a device or IP address not associated with that user in the preceding 30 days, suggesting an attacker hijacked the session or coerced the user after the password reset.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Aggregates password/MFA reset actions by the performing helpdesk identity, alerting on abnormal reset volume or resets outside a normal ticket pattern — a proxy for a support agent being repeatedly socially engineered or a fraudulent-ticket abuse pattern.
Flags re-enablement of legacy/basic authentication protocols or a new per-user authentication-policy exclusion occurring shortly after that account's MFA method was reset — the fallback technique used to sidestep modern MFA once the vishing playbook's reset step succeeds.
Detects an Azure AD/Entra ID device registration or join event occurring within 60 minutes of an account-recovery action (password reset, MFA reset, or account unlock) for the same user identity. This sequence is indicative of an attacker registering a managed device to maintain persistent, long-term access following a successful account takeover or vishing-based helpdesk credential reset.
Detects the removal of phishing-resistant authentication methods (FIDO2 or Windows Hello for Business) and the registration of weaker, phishable MFA methods (SMS, voice, or phone app) within Entra ID. This behavior is indicative of an attacker attempting to lower the security posture of an account to facilitate future credential theft or unauthorized access.
Detects instances where an administrative action involving a password reset or MFA configuration (StrongAuthenticationMethod update) is initiated by a user account that lacks the designated Helpdesk or Password Administrator role. This behavior indicates potential unauthorized privilege escalation or credential manipulation by an account not formally assigned to support workflows.
This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.
Detects a suspicious sequence of events where a user modifies their MFA phone number, followed within 30 minutes by a sign-in event flagged with 'impossibleTravel' or 'unfamiliarFeatures' risk. This pattern is indicative of potential SIM-swap fraud, where an attacker has hijacked the user's phone number to receive MFA prompts and then attempts to access the account from an anomalous location.
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
Detects a suspicious sequence of events where a user modifies the Entra Authentication Methods Policy to register an external authentication method (EAM) provider, followed immediately by the same user associating a new FIDO key with their account. This behavior can be indicative of an adversary setting up a persistence mechanism via a malicious or unauthorized MFA provider.
Detects instances where a user account modifies security information, registers a new MFA method, or resets a password shortly after a successful sign-in from a country not observed for that user within the previous 30 days. This pattern is indicative of potential account takeover where an adversary adds persistence or MFA bypass methods to a newly compromised account.
Page 8 of 29