Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
215 detections
Filters
Last updated
All Time
Detection languages
113
32
28
17
12
Contributors
91
25
13
11
10
Categories
98
88
73
55
48
Platforms
163
83
54
18
5
Products / Services
112
95
59
34
17
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
7
3
2
IDS Classtypes
1
IDS Protocols
1
Detects modifications to a user's multi-factor authentication (MFA) settings, including changes to registered phone numbers, authenticator app configurations, or the registration of new authentication methods. This activity can indicate an attempt to weaken security defenses or gain persistent, unauthorized access to an account via MFA bypass.
This rule detects when a user account updates their MFA information in Azure AD or Microsoft 365, resulting in an increase in the number of associated MFA devices. This is a common indicator of an attacker registering a new MFA device (such as a hardware token or phone app) to a compromised account to establish persistence or bypass existing MFA requirements.
Detects modifications to a user's Azure Active Directory (Entra ID) account involving the addition of a new MFA authentication method or device, such as software tokens or mobile devices. This activity is often performed by an adversary to establish persistence by registering a device they control for future authentication bypass.
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects Okta accounts that enroll a new MFA factor within a short window after multiple failed or abandoned MFA authentication attempts. This behavior is indicative of an attacker who has compromised credentials and is attempting to establish persistent access by bypassing or reconfiguring MFA. The rule includes logic to exclude legitimate self-service enrollments that have a corresponding verified helpdesk or change-management ticket.
Detects Microsoft Entra device registration events where the device name adheres to the 'Forg365-' prefix naming convention. This pattern is indicative of persistence mechanisms used by the Forg365 Phishing-as-a-Service (PhaaS) platform, which registers devices to bypass conditional access or MFA.
Detects abuse of Google Cloud Authenticator device-management API calls associated with the Pass-ta-key attack, where an attacker-controlled key is introduced or a device is de-registered without a legitimate biometric/attestation ceremony. Covers device/register with keys/genpair, device/add_uv_key, and device/forget commands observed in cloud authenticator device-management event logs. To reduce false positives, device/add_uv_key and device/forget calls only alert when they lack an associated preceding hardware attestation or biometric ceremony event, and legitimate user-initiated new-device enrollment (following a known legitimate sign-in with a prior MFA/biometric ceremony on the requesting device) and legitimate account-recovery flows are excluded.
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Entra ID Device Registration Event
Cortex XDR
Detects device registration events within Entra ID. Attackers may register their own device to a compromised account to maintain persistent access or satisfy device-compliance conditional access policies.
This rule detects authentication attempts to the 'Device Registration Service' in Entra ID where the User-Agent string contains 'python'. This is often indicative of automated scripts, such as those using libraries like msal, being used to interact with device management APIs, which may be associated with legitimate automation or adversary activity.
Detects new device registrations in Microsoft Entra ID where the device display name is prefixed with 'Forg365-', a pattern used by the Forg365 PhaaS (Phishing-as-a-Service) platform. This activity is indicative of an adversary establishing persistent, unmanaged device access to compromised Microsoft 365 accounts.
Detects a near-simultaneous correlation between a user registering a new FIDO2 authentication method and a login session from an unmanaged or non-compliant device. This behavioral pattern is often associated with adversary-in-the-middle or vishing attacks where an attacker tricks a user into registering an attacker-controlled security key to maintain persistent MFA access.
Detects Microsoft Entra ID (formerly Azure AD) device registration, ownership assignment, or user assignment operations where the device display name matches a suspicious naming pattern, specifically 'GraphSpy-Device'. This naming convention is often associated with the GraphSpy tool, which is used by adversaries to enumerate and manipulate Entra ID resources, including registering rogue devices to bypass conditional access or MFA.
Page 6 of 11