Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
This rule monitors for suspicious OAuth Device Code flow authentication attempts in Azure AD sign-in logs. It detects activity involving the device code protocol combined with specific error flags or indicators of potentially compromised or non-compliant devices (such as missing device IDs, non-compliant status, or empty trust types), which are indicative of Adversary-in-the-Middle (AiTM) phishing or token interception attacks.
This rule detects successful sign-in attempts to Azure AD (Entra ID) using the Device Code authentication protocol. Device Code flow allows users to sign in to input-constrained devices by using a browser on another device. While legitimate for smart TVs, IoT devices, or CLI tools, this flow is frequently abused by attackers to perform phishing or bypass MFA by tricking users into authorizing an application.
Detects anomalous activity in Microsoft Graph API logs where a single identity (user or application) performs a high volume of requests across multiple sensitive administrative categories, such as directory role management, authentication method modification, application or service principal changes, and OAuth consent operations. This pattern is indicative of potential unauthorized reconnaissance, privilege escalation, or persistence attempts within an Azure/Microsoft 365 environment.
Detects potential abuse of the device-code authentication flow, which is often used in AiTM (Adversary-in-the-Middle) phishing campaigns. The detection looks for device-code authentication attempts followed by specific error codes (50074, 50140) commonly associated with failures in malicious passkey-themed phishing workflows.
This rule identifies potentially malicious Azure AD/Entra authentication flows by flagging interruptions during MFA (e.g., failure codes 50074, 50140 indicating MFA requirements or time-outs during suspected AiTM phishing attempts) and the usage of Device Code Grant flows, which are frequently abused by adversaries to bypass MFA and capture session tokens.
This rule detects potential identity compromise via abuse of the OAuth device-code grant flow. It monitors for successful user logins leveraging the device code flow, which is a common indicator of AiTM (Adversary-in-the-Middle) phishing campaigns that lure users into authorizing malicious applications under pretexts like security updates or SSO re-authentication.
Detects process creation events containing command-line arguments indicative of an OAuth 2.0 device code flow, commonly used in consent phishing or device code phishing attacks to hijack account access via a malicious OAuth application registration.
Detects a suspicious sequence of events where a user initiates a device code authorization flow, immediately followed by a Microsoft Authentication Broker sign-in using the 'sso_reload=true' parameter. This pattern is indicative of an attacker hijacking the device code authorization process to gain unauthorized access to a user's session.
This rule detects suspicious Azure AD sign-in activity originating from a single user account that utilizes the 'deviceCode' authentication protocol while simultaneously exhibiting activity from multiple distinct and highly specific User Agent strings (Python requests library and Microsoft Outlook 16.0.17425). This pattern is indicative of potential token theft or automated credential harvesting where a legitimate OAuth flow is subverted to gain persistent access.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to JeetBot/Twitch Enhanced Viewer malicious browser extension infrastructure exfiltrating Twitch OAuth tokens. Apex domains (jeetbot.cc, api.jeetbot.cc) are gated on a token-forwarding indicator to avoid false positives.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects automated mailbox access operations such as 'MailItemsAccessed' or 'Search-Mailbox' that are filtered by specific, high-risk financial or Business Email Compromise (BEC) keywords in the email subject line. This behavior is indicative of an automated 'inbox-monitor' style attack, where a compromised OAuth token is used to systematically scrape mailboxes for sensitive financial data.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects anomalous activity associated with OAuth 2.0 device code phishing campaigns. The rule identifies accounts showing frequent device code authentication attempts, including successful logins from potentially unmanaged or unrecognized devices, which is consistent with the behavior of phishing kits targeting OAuth device grant flows.
Page 18 of 37