Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
215 detections
Filters
Last updated
All Time
Detection languages
113
32
28
17
12
Contributors
91
25
13
11
10
Categories
98
88
73
55
48
Platforms
163
83
54
18
5
Products / Services
112
95
59
34
17
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
7
3
2
IDS Classtypes
1
IDS Protocols
1
Detects the registration of a new FIDO2 security key or passkey in Entra ID that is associated with a sign-in from an unmanaged or non-compliant device shortly before or after the registration. This behavior often suggests a vishing or social engineering scenario where an attacker guides a user through an authentication method registration process while impersonating IT support.
This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.
Detects indicators of Device Code Lab's PRT Refresh capability, where an administrator's 'Revoke all sessions' (revokeSignInSessions) action is followed by a prt-refresh backend call that reactivates the attacker's session without new user interaction, bypassing standard OAuth refresh token revocation.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
This rule detects network activity indicating a potential modification or interaction with Microsoft Entra ID (Azure AD) multifactor authentication (MFA) settings. Specifically, it looks for POST requests to the Microsoft Graph API targeting authentication methods (e.g., phoneAuthenticationMethod), which may be indicative of an attacker modifying MFA settings to bypass security controls or register rogue authentication devices.
Detects suspicious device registrations to Azure AD's Device Registration Service (DRS) using the device code flow. This rule identifies registrations where the device OS attributes are suspicious (e.g., version 0.0.0.0) or where a non-Windows OS claims a Windows identity, potentially indicating an adversary attempting to bypass conditional access policies or gain persistent access.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, specifically targeting behaviors associated with threat groups like BlackFile and Cordial Spider. The rule identifies these activities by filtering Okta SSO raw logs for specific event types related to MFA and device management, and then correlating them with known proxy ASN organizations or Okta's internal proxy flags.
Detects network requests to Microsoft Graph API endpoints related to MFA method configuration. This pattern often indicates an adversary attempting to add, modify, or register new MFA authentication methods (such as phone-based methods) for an account to facilitate persistence or bypass security controls.
Detects the use of the AADInternals PowerShell module for suspicious device registration activities, such as phantom device creation and Primary Refresh Token (PRT) manipulation, which are common techniques used to bypass Conditional Access policies. The rule correlates PowerShell command execution containing AADInternals cmdlets with subsequent Azure AD device registration events originating from the same host within a 15-minute window.
Detects anomalous device registration in Azure AD where a device code flow is used to authenticate to the Device Registration Service (DRS) and the resulting device is registered with an 'Unknown' or 'Linux' operating system. This behavior is indicative of an adversary, such as Storm-2372, using tools like AADInternals to perform phantom device registration to bypass conditional access policies by simulating a device without TPM attestation.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
This rule detects attempts to register a new Authenticator app or phone number for multi-factor authentication (MFA) from an IP address that is not typically associated with the user's sign-in behavior. This could indicate a compromised account where an attacker is attempting to establish a new MFA method to maintain access.
Detects the threat actor creating inbox rules to delete or archive emails containing keywords like "deposit", "payroll", "HR", "Workday", or "ADP" to hide their tampering, often associated with the Storm-2755 campaign.
Detects MFA device registration occurring during a suspicious session heavily focused on HR portal access. This rule correlates MFA registration events with access to HR applications like Workday or ADP within a 10-minute window, indicating potential account takeover or unauthorized access attempts.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects the attacker leveraging a stolen token to create or modify inbox rules (e.g., moving emails to RSS Subscriptions or Archive) to hide their activities. This rule specifically looks for actions like 'New-InboxRule' or 'Set-InboxRule' with parameters indicating email manipulation such as 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead'.
Detects bulk reconnaissance against multiple Microsoft Graph API endpoints (users, groups, roles, etc.) by scripting clients, correlated with a recent device registration event by the same user principal. This behavior is indicative of a Storm-2372 conditional access bypass strategy followed by rapid directory environment enumeration.
Detects anomalous Azure AD device registration events where device metadata is inconsistent, suggesting impersonation. The rule flags Linux hosts masquerading as Windows, non-Windows devices claiming AzureAD trust type, or the use of zeroed OS versions (0.0.0.0). High-frequency registrations (3+ devices per user in 30 minutes) correlate with known AADInternals-based attacks used by threat actor Storm-2372 to bypass Conditional Access policies.
Detects the creation of a Temporary Access Pass (TAP) by a service principal or agent identity, rather than a human administrator. This scenario indicates a potential compromise where a Temporary Access Agent with UserAuthMethod-TAP.ReadWrite.All permission is abused to generate a TAP for a Global Administrator.
Detects the attacker leveraging a stolen session token to create or modify inbox rules that move finance or payroll related emails to the Archive or Trash folders, or delete them, as observed in Tycoon2FA phishing campaigns.
Page 7 of 11