Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
Detects anomalous activity associated with OAuth 2.0 device code phishing campaigns. The rule identifies accounts showing frequent device code authentication attempts, including successful logins from potentially unmanaged or unrecognized devices, which is consistent with the behavior of phishing kits targeting OAuth device grant flows.
Detects anomalous activity associated with OAuth 2.0 device code phishing campaigns. The rule identifies accounts showing frequent device code authentication attempts, including successful logins from potentially unmanaged or unrecognized devices, which is consistent with the behavior of phishing kits targeting OAuth device grant flows.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
Detects anomalous access to sensitive Microsoft Graph API endpoints (messages, mailFolders, contacts) following a device-code authentication. The rule specifically flags activity from non-standard or generic client applications, which is a pattern often associated with post-compromise proxying or token abuse, such as the 'ARToken' technique.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
Detects successful authentication events in Microsoft Entra ID (formerly Azure AD) that utilize the 'device code' OAuth flow. This flow is often used by command-line utilities and headless applications to authenticate users on devices without a web browser, but it is also frequently abused by attackers to perform phishing and session hijacking.
Detects anomalous activity in Azure AD/Microsoft Graph API logs, where a specific user or application performs a high volume of requests across multiple sensitive administrative categories (such as directory roles, authentication methods, applications, and service principals) within a 30-minute window. This behavior is often indicative of reconnaissance or privilege escalation attempts by an adversary who has compromised an identity.
Detects any successful login event for a user in an Azure AD environment. The rule acts as a coarse proxy for potential device-code grant-type authentication, pending the availability of more granular protocol and grant-type fields in the environment's telemetry.
Detects user authentication events that exhibit patterns consistent with Adversary-in-the-Middle (AiTM) phishing campaigns, specifically those leveraging passkey or SSO-themed lures and device-code authentication flows.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to JeetBot/Twitch Enhanced Viewer malicious browser extension infrastructure exfiltrating Twitch OAuth tokens. Apex domains (jeetbot.cc, api.jeetbot.cc) are gated on a token-forwarding indicator to avoid false positives.
Detects OAuth2 JWT bearer-grant token requests to Google's OAuth endpoint using the attacker-controlled service-account identity and Sheets API scope observed in the fake GlobalProtect campaign
Detects instances of OAuth device code flow authentication from suspicious sources (e.g., unfamiliar devices, non-compliant/unmanaged devices, or unusual geographic locations) that are followed closely by an OAuth application consent event. This behavior is indicative of potential consent phishing or device code phishing attacks attempting to gain persistent access to cloud resources.
Detects high-risk account modifications, such as adding MFA methods or OAuth consent grants, occurring shortly after a user sign-in. This pattern is indicative of post-AiTM session theft (e.g., NovaCookies) where an adversary uses a stolen session token to modify account settings for persistence or MFA bypass.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
This rule detects potentially malicious OAuth application consent grants in Microsoft Entra ID (formerly Azure AD). It monitors for consent events involving high-risk scopes by non-verified publishers, instances of admins attempting to bypass consent requirements, and follows up by checking for unusually high activity (sign-ins or resource access) from the newly consented application within a short timeframe.
Detects the use of the OAuth device code authentication flow in Azure AD/Entra ID sign-in events. This flow is frequently abused by attackers who use vishing or SMS phishing pretexts to trick users into authorizing a device login, enabling the attacker to obtain a valid session token without direct credential harvesting or cookie theft.
Detects anomalous authentication behavior where a user successfully completes an OAuth device-code grant, followed by a subsequent login event using the same user context but originating from a different source IP address. This pattern is indicative of device-code phishing, where an adversary tricks a user into authorizing a device, then uses the resulting session or token from their own infrastructure.
Page 19 of 37