Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
This rule detects anomalous behavior where a single user account registers multiple devices within a very short timeframe (80 seconds). This pattern often follows the theft of a device code or OAuth authorization token, where an adversary attempts to rapidly enroll multiple rogue devices to maintain persistent access or bypass MFA controls.
This rule monitors network connections and DNS queries directed towards Microsoft's OAuth device code authorization endpoints ('/common/oauth2/deviceauth' or '/device'). This flow is frequently abused by adversaries to perform device code phishing, allowing them to gain access to a victim's account without requiring the user's password or bypassing traditional MFA.
Detects suspicious OAuth device code authorization requests matching the GhostCode phishing kit's pattern. The rule identifies the use of a known Microsoft Authentication Broker App ID (29d9ed98-a469-4536-ade2-f981bc1d605e) coupled with the 'python-requests' user agent, which are characteristic indicators of the phishing backend server attempting to authorize malicious requests.
This rule detects successful authentication events using the Microsoft OAuth device code flow, which is often abused in phishing campaigns to hijack user sessions. It flags authentication attempts that match specific device authorization URLs, include signs of bypassing security warnings, or indicate a lack of direct user authentication interaction.
Detects OAuth 2.0 device authorization grant requests utilizing the Microsoft Authentication Broker application ID (29d9ed98-a469-4536-ade2-f981bc1d605e) with sensitive scopes like 'https://graph.microsoft.com/.default'. This specific application ID is frequently impersonated by phishing kits (e.g., GhostCode) to facilitate token theft via device code flow abuse, where adversaries trick users into authenticating to a legitimate-looking but attacker-controlled flow.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects instances where a user successfully authenticates using the OAuth 2.0 device code flow, and the resulting token is subsequently used from a different IP address or by a different client application, indicating potential token theft or session hijacking.
Detects unauthorized access to Discord's Local Storage leveldb files, a technique commonly used by malware like LxBaseRAT to extract Discord authentication tokens.
Detects a sequence of activity where an anonymous AWS token is requested via a specific API path, followed within 15 minutes by a token minting call from the same source IP. This behavior is indicative of a token-theft or privilege escalation chain.
This rule detects potential Device Code Phishing (OAuth 2.0 device authorization) attempts by monitoring HTTP requests to the Microsoft device authorization endpoint (login.microsoftonline.com/common/oauth2/deviceauth) that originate from a suspicious referrer domain ending in .de. This behavior is indicative of an attacker-controlled landing page directing users to authenticate their device.
This rule detects potential Device Code Phishing (OAuth 2.0 device authorization) attempts by monitoring HTTP requests to the Microsoft device authorization endpoint (login.microsoftonline.com/common/oauth2/deviceauth) that originate from a suspicious referrer domain ending in .de. This behavior is indicative of an attacker-controlled landing page directing users to authenticate their device.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects successful device code authentication flows involving applications that are not part of a known list of standard Microsoft and Azure client applications. Device code flows are frequently abused in phishing attacks to bypass traditional credential-based authentication.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects anomalous activity associated with OAuth 2.0 device code phishing campaigns. The rule identifies accounts showing frequent device code authentication attempts, including successful logins from potentially unmanaged or unrecognized devices, which is consistent with the behavior of phishing kits targeting OAuth device grant flows.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Page 17 of 37