Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects the publication of a known malicious version (0.2.21) of the '@dforge-core/dforge-mcp' npm package. This activity is attributed to the GHAPPIER/PolinRider supply chain campaign, which leverages hijacked OIDC trusted-publishing pipelines to distribute compromised code.
Detects anomalous activity in GitHub repositories where a code push by an actor is followed by an NPM package publish event from the same actor within a 105-minute window. This behavioral pattern is indicative of a potential compromised maintainer session or malicious code injection into the software supply chain.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects potentially unauthorized or anomalous activations of highly privileged Entra ID roles (e.g., Global Administrator). The rule identifies activations that lack a business justification, occur during unusual hours (outside of 06:00-22:00), or exhibit burst patterns of repeated activation/deactivation cycles which may indicate automated credential abuse or persistence attempts.
Detects network requests to the Microsoft authentication service specifically targeting the /common/oauth2/deviceauth endpoint, which is used in the OAuth 2.0 Device Authorization Grant flow. While legitimate for device authentication (e.g., CLI tools, smart devices), this flow can be abused by adversaries for phishing attacks to bypass traditional credential-based MFA, allowing them to gain persistent access to a user account once the target authorizes the code.
Detects anomalous AWS STS GetCallerIdentity activity characterized by multiple failed authentication attempts (InvalidClientTokenId, SignatureDoesNotMatch, AccessDenied, AuthFailure, InvalidAccessKeyId). This pattern is consistent with an adversary performing bulk validation of stolen or harvested AWS IAM access keys to identify valid credentials.
Detects a pattern where a single source IP address performs multiple successful authentications across different cloud account identifiers within a short timeframe. This behavior is indicative of automated credential spraying, multi-agent automated access, or potential account takeover activity targeting multiple accounts within a cloud environment.
Detects signs of the TrustSink technique where an Entra sign-in process, while at the MFA stage, is intercepted by redirecting the user to a rogue External Authentication Method (EAM) provider. This unauthorized provider typically uses look-alike domains or tunneling services to host phishing pages that harvest plaintext credentials and return forged MFA tokens to Entra.
Detects successful authentication events that rely on external authentication method providers, which may indicate an adversary is using a rogue MFA provider to bypass standard authentication controls or to perform adversary-in-the-middle (AiTM) attacks.
Detects successful authentication events that rely on external authentication method providers, which may indicate an adversary is using a rogue MFA provider to bypass standard authentication controls or to perform adversary-in-the-middle (AiTM) attacks.
Detects Workday self-service banking detail changes occurring shortly after suspicious mailbox reconnaissance activities, such as searching for payroll-related terms or accessing sensitive documents. This behavior is indicative of a payroll diversion fraud scheme following an Adversary-in-the-Middle (AiTM) session hijacking attack.
Detects Microsoft 365 / Entra ID sign-in events where the reported client application is Microsoft Outlook but the User-Agent string is inconsistent with Outlook's standard Edge-based WebView. This behavioral discrepancy often indicates the use of automated HTTP clients to replay stolen session tokens in Adversary-in-the-Middle (AiTM) phishing campaigns, allowing attackers to maintain authenticated access for reconnaissance and data collection.
Detects Microsoft Entra OAuth 2.0 device authorization grant flow completion immediately followed by non-interactive API access from automated user agents like python-requests. This behavior is indicative of device code phishing kits, where an attacker tricks a user into entering a code and then programmatically hijacks the resulting session token.
Detects the issuance of a Primary Refresh Token (PRT) to Microsoft Graph occurring in close temporal proximity to a device code authentication flow. This pattern is indicative of device-code phishing attacks, where an adversary intercepts a device code to obtain long-lived, session-persistent access to a tenant.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects sign-in events where Multi-Factor Authentication (MFA) was satisfied using an External Authentication Method (EAM) that asserts specific possession or inherence claims (e.g., 'hwk' - hardware key). This behavior may indicate an adversary attempting to bypass or forge MFA responses via a rogue EAM provider.
Detects sign-in events where Multi-Factor Authentication (MFA) was satisfied using an External Authentication Method (EAM) that asserts specific possession or inherence claims (e.g., 'hwk' - hardware key). This behavior may indicate an adversary attempting to bypass or forge MFA responses via a rogue EAM provider.
This rule detects successful authentication events for any user within the monitored environment. This serves as a foundational building block for detecting anomalous user behavior, particularly when combined with additional identity provider audit logs such as MFA method usage or registration timestamps to identify potential MFA bypass or persistence via newly registered MFA devices.
Page 20 of 52