Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
82 detections
Filters
Last updated
All Time
Detection languages
47
11
8
6
6
Contributors
26
15
8
6
4
Categories
42
31
28
19
16
Platforms
46
28
15
13
8
Products / Services
47
20
11
11
9
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
5
3
2
1
IDS Protocols
11
Detects anomalous Microsoft Entra ID sign-in events where the application accessed is the Microsoft Authentication Broker (AppId 29d9ed98-a469-4536-ade2-f981bc1d605e) and the User-Agent indicates a Node.js automated backend ('node' or 'undici'). This combination strongly suggests Tycoon2FA operator polling for device-code token acquisition.
Detects abnormal MFA session behavior by monitoring user sessions with multiple IPs or browsers over 24h. Note: KQL 14-day historical baseline and set_difference logic is approximated.
This rule detects multiple failed sign-in attempts using the 'Device Code' authentication flow from various IP addresses or locations for a single user. This behavior can indicate an adversary attempting to bypass multi-factor authentication (MFA) or gain unauthorized access through device code phishing or brute-force attacks against the device code flow. The rule specifically looks for more than 3 attempts from more than 2 distinct IP addresses or locations, targeting common Microsoft applications like Office, Teams, Azure Portal, or Graph.
Detects behavioral patterns
This rule identifies risky sign-in attempts in Azure Active Directory where the sign-in originates from an IP address that has not been seen before or has been seen fewer than 3 times in the last 29 days for that specific user. It filters out guest users, non-compliant devices, and unmanaged devices, focusing on sign-ins with an aggregated risk level greater than 1 and a sign-in risk level of 50 or higher. Excluded applications are specified to reduce false positives.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity, commonly associated with frameworks like Evilginx. The rule identifies suspicious domain patterns where legitimate identity provider (IdP) domains are used as subdomains of another domain, or where IdP-related keywords are used in hyphenated subdomains.
Detects indicators of compromise (IOCs) and suspicious OAuth consent activity
linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft
OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft
OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
This rule detects suspicious Okta login attempts where a user successfully passes the initial authentication factor but then fails or abandons a subsequent Multi-Factor Authentication (MFA) challenge, originating from a new IP address, device (user agent), and city combination. It filters out events from known corporate VPN IP addresses to reduce false positives.
Detects when a user's phone authentication method is changed or added, followed shortly by a successful MFA-based sign-in for that same user. This pattern can indicate a SIM swap attack where an adversary socially engineers a helpdesk or convinces a mobile carrier to port a user's number to an adversary-controlled SIM card. This allows the adversary to intercept MFA codes sent via SMS or phone call and gain unauthorized access.
KQL Query from file: Detecting FIDO2 Passkey Abuse
KQL Query from file: Sneaky 2FA MDO Detection
KQL Query from file: User Sign-in Activity
KQL Query
Looks for a new MFA method added to an account that was preceded by medium or high risk sign-in session for the same user within maximum 6h timeframe
'Detects successful signins using single factor authentication where the device, location, and ASN are abnormal.
Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'
Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'
'Correlate IPs blocked by a Cisco firewall appliance with successful Microsoft Entra ID signins.
Because the IP was blocked by the firewall, that same IP logging on successfully to Entra ID is potentially suspect and could indicate credential compromise for the user account.'
Because the IP was blocked by the firewall, that same IP logging on successfully to Entra ID is potentially suspect and could indicate credential compromise for the user account.'
' Identifies failed MFA attempts from Privileged accounts. Privileged accounts list can be based on IdentityInfo UEBA table or built-in watchlist.
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
This query helps hunting for Automated email notifications and suspicious sign-in activity
'Identifies an interrupted sign-in session from a country the user has not sign-in before in the last 7 days, where the password was correct. Although the session is interrupted by other controls such as multi factor authentication or conditional access policies, the user credentials should be reset due to logs indicating a correct password was observed during sign-in.'
Page 4 of 4