Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
This rule detects potential token theft or MFA bypass by correlating successful MFA-satisfied interactive sign-ins with subsequent non-interactive sign-ins (token refreshes) occurring within a 60-minute window from different IP addresses for the same user. This pattern is indicative of an attacker stealing a session token (e.g., via session cookie theft or AiTM phishing) and using it to authenticate from a different location.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.
This rule detects processes other than standard web browsers performing network connections that coincide with OAuth token acquisition activities (POST requests containing 'access_token' in the response body). This behavior is indicative of potential token theft or unauthorized programmatic access to OAuth-protected resources.
Detects the compromised user granting read/write permissions to a highly privileged, unfamiliar third-party application via the OAuth consent framework. Specifically looks for 'Consent to application' operations where granted permissions include 'Mail.ReadWrite', 'Contacts.Read', or 'offline_access'.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects unauthorized processes attempting to access browser cookie storage files, which are commonly targeted by infostealer malware to extract session cookies for services like Jira and Atlassian SSO. Extracting these tokens allows attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to accounts.
Detects the LokiBot information stealer by identifying its characteristic aPLib compressed payloads, specific C2 URI patterns, known C2 infrastructure, and credential theft routines targeting applications like 1Password, Keepass, and WinBox.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects attempts to list, read, create, update, or delete Kubernetes secrets via the Kubernetes API server. This activity can indicate an adversary attempting to gain access to sensitive information or manipulate the environment.
Detects an account granting offline access, mail, files, directory, or user impersonation permissions shortly after anomalous authentication. This rule is designed to identify potential persistence mechanisms established by adversaries leveraging OAuth applications, as seen in campaigns like Tycoon 2FA AITM.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects when a user grants consent to a third-party application via the OAuth consent framework, specifically looking for grants that include highly privileged permissions such as Mail.ReadWrite, Contacts.Read, or offline_access. This can indicate a compromised user account being used to establish persistence or gain further access through a malicious application.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
This rule detects when a non-administrative user grants an application high-privilege OAuth scopes (such as mail reading, file access, or directory management) within an Azure/Microsoft 365 environment. Such consent grants can be used by attackers to maintain persistence and bypass MFA by gaining delegated access to sensitive resources.
Detects anomalous, non-interactive Microsoft Graph sign-in activity consistent with the Payroll Pirate session hijacking campaign. The rule flags instances where the same user account authenticates via Microsoft Graph using the 'Firefox/131.0' user agent from multiple distinct source IP addresses within a 6-hour window, indicating potential stolen session token replay from distributed proxy infrastructure.
Identifies the compromised session token being reused rapidly across Exchange Online, SharePoint, and Teams from a single IP to harvest data. This rule detects when a single account object ID and IP address access 3 or more distinct applications within a 5-minute window, which could indicate the reuse of a compromised token.
Detects suspicious OAuth application or service principal registration, or permission consent, performed by users who are not part of designated IT administrator groups. This rule flags high-privilege permission grants (e.g., Mail.Read, Directory.ReadWrite.All) or application consent events, which are common methods for establishing long-term persistence in cloud environments.
Detects successful OAuth application consent events where the requested permissions include sensitive scopes such as Mail, Files, or User profile access. This is a common indicator of OAuth application-based phishing or persistence attempts, often referred to as 'Illicit Consent Grant' attacks.
Page 29 of 37