Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
215 detections
Filters
Last updated
All Time
Detection languages
113
32
28
17
12
Contributors
91
25
13
11
10
Categories
98
88
73
55
48
Platforms
163
83
54
18
5
Products / Services
112
95
59
34
17
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
CVEs
7
3
2
IDS Classtypes
1
IDS Protocols
1
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Detects five or more Entra ID device registrations by a single account where device names match microsoft-* or WINDOWS-* patterns, occurring shortly after a device code flow sign-in by the same account. This behavior is indicative of device registration abuse or persistent access attempts.
Detects a user account that performs a device code sign-in flow followed by the registration of five or more devices with deceptive names (matching patterns like microsoft- or windows-) within a one day timeframe. This behavior can indicate an adversary establishing persistence or attempting tenant resource exhaustion using compromised accounts.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes
(EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user
to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.
(EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user
to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Correlates an Entra ID MFA/authenticator reset with a new device registration within 30 minutes for the same account. Models the Scattered Spider (UNC3944/Octo Tempest) and CrowdStrike-tracked 'Mutant Spider' helpdesk-vishing playbook, where Mandiant's M-Trends 2026 measured ~40 minutes from vished reset to domain admin.
Detects instances where a user account registers a new MFA security method shortly after an initial successful sign-in from an unfamiliar device or network (Autonomous System Number). This behavioral pattern is characteristic of attackers, such as ShinyHunters vishing operators, who gain initial access via compromised credentials and subsequently enroll their own MFA devices to establish persistent access.
Detects instances where an administrative, helpdesk, or support account registers or updates security info (such as MFA methods) for a user, specifically when this action is preceded by a password reset for that same user. This pattern is indicative of account takeover attempts, particularly those involving vishing-based social engineering of helpdesk staff to bypass MFA.
Detects registration of a new actor-controlled MFA authentication method (phone, authenticator app, or software OTP token) via an Update user operation, matching the NO_DEVICE/NO_DEVICE_TOKEN/SoftwareTokenActivated pattern used to convert temporary compromise into durable identity persistence
Detects instances where a user performs high-risk sign-in activities (such as impossible travel or triggered risk events) followed by the registration of new security information, MFA methods, or rogue OAuth devices within a 30-minute window. This behavior is indicative of an attacker establishing persistence on a compromised account by bypassing or hardening MFA requirements.
Detects potential account takeover by monitoring identity providers (Azure AD or Okta) for MFA method resets or deletions immediately followed by new MFA method registrations for the same user. This behavior is highly characteristic of Scattered Spider's (Octo Tempest) tactic of social-engineering help-desk staff to perform MFA resets, allowing the adversary to enroll their own device to bypass MFA and maintain persistence.
Detects the registration of a new authentication method (e.g., FIDO2 key, authenticator app) shortly after a user account experiences a risky sign-in event. This pattern is indicative of an adversary attempting to establish persistent access and bypass MFA requirements, often following a successful AiTM (Adversary-in-the-Middle) phishing attack.
This rule detects when a user registers or adds a new device in Entra ID within a short timeframe (two hours) of experiencing a risky sign-in or a password reset. It specifically flags registrations involving potentially unmanaged, non-compliant, or unusually trusted devices, which may indicate an attempt to establish persistent access or bypass Conditional Access policies.
Detects the registration of a new MFA authentication method on an Entra ID account from an unrecognized IP or device, occurring in close temporal proximity to a password reset or a risky sign-in event. This behavior is indicative of an adversary establishing persistence via self-service MFA registration after compromising user credentials.
This rule monitors Office 365 management logs for device registration or join events in Azure Active Directory where the resulting device state is flagged as both non-compliant and unmanaged, despite having a 'Workplace' or 'AzureAd' trust type. It further aggregates these events by user to identify potential suspicious patterns, such as bulk registrations or rapid activity within a 30-minute window, which may indicate account compromise or unauthorized device enrollment.
Page 1 of 11