Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
82 detections
Filters
Last updated
All Time
Detection languages
47
11
8
6
6
Contributors
26
15
8
6
4
Categories
42
31
28
19
16
Platforms
46
28
15
13
8
Products / Services
47
20
11
11
9
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
5
3
2
1
IDS Protocols
11
This rule detects network events where the 'AdditionalFields' contain keywords commonly associated with Multi-Factor Authentication (MFA) such as 'otp', 'verify', '2fa', or 'mfa', and the 'RemoteIP' is a valid IPv4 address. This could indicate attempts to interact with, or potentially bypass, MFA mechanisms.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
Detects MFA authentication success from one IP address followed immediately by a session access attempt from a different IP address. This pattern is characteristic of Adversary-in-the-Middle (AiTM) phishing attacks, such as those using EvilProxy, Evilginx2, or similar phishing-as-a-service (PhaaS) platforms, where an adversary proxies the authentication flow to capture session tokens.
Detects when the default SMS application on an Android device is changed to an application that is not recognized as a trusted SMS provider. This behavior is often indicative of malicious applications attempting to intercept incoming SMS messages, such as those containing multi-factor authentication (MFA) codes, by positioning themselves as the system's primary handler for SMS communications.
Detects IMAP, POP, SMTP AUTH, or other legacy authentication activity soon after the same account completes modern MFA. This could indicate an adversary bypassing MFA by using legacy protocols after successfully authenticating with modern MFA.
Detects when the default SMS application on an Android device is changed to an application that is not recognized as a trusted SMS provider. This behavior is often indicative of malicious applications attempting to intercept incoming SMS messages, such as those containing multi-factor authentication (MFA) codes, by positioning themselves as the system's primary handler for SMS communications.
This rule detects the execution of processes with command lines containing keywords associated with Snake Keylogger, such as 'snake', 'snakekeylogger', 'keylog.exe', or 'logger.dll'. This indicates potential keylogger activity on the endpoint.
This rule detects EvilTokens device code OAuth phishing by identifying rapid, repeated POST requests to the /common/oauth2/token endpoint with a device_code grant and authorization_pending responses, followed by a successful token issuance and sign-in without an MFA claim. This pattern is consistent with EvilTokens session harvesting.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
Detects reverse proxy phishing pages designed to intercept MFA OTP codes
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects the execution of processes with command lines containing keywords associated with Snake Keylogger, such as 'snake', 'snakekeylogger', 'keylog.exe', or 'logger.dll'. This indicates potential keylogger activity on the endpoint.
This rule detects potential multi-factor authentication (MFA) bypass attempts for privileged accounts. It identifies instances where an administrative user attempts 10 or more sign-ins from 3 or more unique devices within a 5-minute window, specifically when the authentication method is 'Push notification to app' and the result type is '0' (success). This behavior could indicate an adversary attempting to bypass MFA for a privileged account.
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects multiple failed sign-in attempts using the 'Device Code' authentication flow from various IP addresses or locations for a single user. This behavior can indicate an adversary attempting to bypass multi-factor authentication (MFA) or gain unauthorized access through device code phishing or brute-force attacks against the device code flow. The rule specifically looks for more than 3 attempts from more than 2 distinct IP addresses or locations, targeting common Microsoft applications like Office, Teams, Azure Portal, or Graph.
This rule detects potential multi-factor authentication (MFA) bypass attempts for privileged accounts. It identifies instances where an administrative user attempts 10 or more sign-ins from 3 or more unique devices within a 5-minute window, specifically when the authentication method is 'Push notification to app' and the result type is '0' (success). This behavior could indicate an adversary attempting to bypass MFA for a privileged account.
This rule detects HTTP requests that contain both 'otp' and 'verify' in the URI, which is indicative of a phishing page designed to capture One-Time Passwords (OTP) or Multi-Factor Authentication (MFA) codes. The rule is specifically looking for patterns associated with reverse proxy phishing techniques.
This rule detects potential session hijacking or replay attacks where a stolen MFA (Multi-Factor Authentication) session cookie is replayed from a new IP address. It specifically looks for HTTP traffic containing 'auth', 'session', or 'mfa' in the cookie header. A threshold of 5 occurrences within 5 seconds, tracked by destination IP, is used to trigger the alert, indicating suspicious activity.
This rule detects potential MFA bypass attempts using Evilginx by looking for HTTP POST requests to the server that contain both 'session' and 'token' in the URI, with a body size greater than 100 bytes. This pattern is indicative of session token capture, a technique used by Evilginx to bypass multi-factor authentication.
Detects successful Microsoft Entra ID sign-ins where the user agent indicates a Node.js-based HTTP client (e.g., node, axios, undici, node-fetch). Tycoon 2FA and other AiTM phishing kits heavily leverage these backend automated tools for token relay and renewal immediately following MFA interception.
Detects possible MFA-approved session replay by identifying abnormal reuse of authenticated sessions across multiple IPs, browsers, and devices compared against a 14-day historical baseline. The rule prioritizes browser/device anomalies over geography since modern attackers often use same-country VPS/proxies.
Page 3 of 4