Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
Detects spearphishing emails that contain both a link to the legitimate 'microsoft.com/devicelogin' page and the phrase 'device code'. This is a common social engineering tactic used to trick users into providing a device authorization code to an attacker, enabling them to bypass MFA and hijack user sessions via OAuth device code flow.
Detects successful authentication events in Azure SigninLogs that utilize the Device Code OAuth flow. Attackers may leverage this flow in phishing campaigns or to bypass MFA by tricking users into authorizing malicious devices, which can lead to subsequent token theft.
Detects authorization, token grants, or consent events for two specific Google Workspace application ClientIDs, which may be indicative of OAuth application consent abuse or malicious integration.
This rule monitors audit logs for anomalous OAuth application configurations, specifically focusing on excessive scope counts, Redirect URI mismatches, Client ID mismatches, and cross-client token exchange irregularities, which may indicate malicious OAuth application registration or configuration for token theft.
This rule detects the use of the OAuth 2.0 Device Code Authorization flow directed towards 'microsoft.com/devicelogin'. This authentication method is frequently abused by attackers in phishing campaigns to hijack device-based user sessions by tricking victims into entering a device code on a malicious site, effectively bypassing traditional password-based authentication.
Detects high volumes of file download operations from OneDrive or SharePoint occurring within one hour of a device-code authentication event. This pattern is indicative of potential data exfiltration by an adversary using a stolen access token obtained via an OAuth device-code phishing attack.
Detects attempts to retrieve Azure Container Registry (ACR) credentials, either by executing specific Azure CLI commands on a host or by initiating the Microsoft.ContainerRegistry/registries/listCredentials/action via Azure Activity Logs. Such activities may indicate an adversary attempting to gain unauthorized access to container registries.
This rule detects new or anomalous Google Workspace OAuth authorization events by monitoring for actions related to OAuth, consent, tokens, or authorization from IP addresses, geographical locations, or devices that have not been observed for the specific user account within the past 30 days.
Detects instances where users grant broad permissions (e.g., Mail.Read, Files.ReadWrite) to newly registered or unknown applications. It specifically correlates these grants with device code flow authentication, a technique frequently used in OAuth consent phishing to bypass traditional authentication hurdles.
Detects the creation of applications or service principals in Azure AD that involve sensitive OAuth permissions (e.g., Mail.ReadWrite, Files.ReadWrite.All) when performed by users identified with elevated risk levels or outside of standard business hours.
This rule detects unauthorized requests to the '/api/tokens/import/txt' endpoint, which is associated with the 'Device Code Lab' token management panel. Such activity is indicative of an attacker importing stolen session tokens to maintain persistent access to a compromised environment.
Detects the creation or update of mailbox inbox rules within 30 minutes of a successful sign-in event using the OAuth device code flow. This sequence is often observed in Business Email Compromise (BEC) attacks where an attacker uses a stolen or phished device code to access a mailbox and subsequently establishes persistence via malicious mail forwarding or deletion rules to hide their tracks.
Detects unauthorized attempts by low-privileged API tokens to access sensitive Argo CD endpoints related to Git repository credentials and project configurations. This rule specifically monitors for exploitation patterns associated with CVE-2025-55190, where tokens with read-only access could retrieve secrets they are not authorized to view.
Detects potential OAuth device code phishing attacks by identifying HTTP requests to the legitimate microsoft.com/devicelogin URL containing suspicious user_code or device_code parameters. This pattern indicates an adversary is using an OAuth device authorization grant flow to steal tokens or gain unauthorized access without the victim needing to provide credentials directly to the attacker.
This rule detects suspicious Google OAuth authorization requests directed at accounts.google.com that utilize a local redirect URI (http://localhost) and are missing mandatory security parameters such as code_challenge, state, and login_hint. These characteristics are often associated with OAuth-based phishing or credential theft campaigns where an adversary attempts to intercept authorization codes.
This rule monitors for potential lateral phishing activity within an organization by identifying internal accounts sending high volumes of emails, correlating this with MailItemsAccessed audit events from unexpected IPs, and detecting OAuth token abuse patterns (such as granting consent or adding credentials) within the Exchange Online environment.
This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.
Detects unauthorized processes attempting to access Discord's local LevelDB storage files, which are commonly targeted by info-stealing malware to extract sensitive session tokens and user data.
Detects high-risk administrative or user actions within Microsoft 365 environments that are frequently associated with adversary persistence, data exfiltration, and privilege escalation. The rule monitors for the creation or modification of inbox forwarding rules, addition of mailbox permissions, OAuth application consent grants, bulk mailbox searches, and programmatic access to mail items via EWS or Graph API.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
Detects anomalous non-interactive OAuth token requests against Microsoft Graph that claim multi-factor authentication (MFA) satisfaction from unmanaged devices. This behavior is indicative of Adversary-in-the-Middle (AiTM) token replay attacks, where captured session tokens are reused by an attacker to bypass authentication controls, consistent with tactics used by threat actors like Storm-2755 (Payroll Pirate).
Page 26 of 37