Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
181 detections
Filters
Last updated
All Time
Detection languages
114
27
13
10
5
Contributors
63
37
19
10
5
Categories
67
53
53
44
40
Platforms
81
80
40
28
15
Products / Services
63
40
32
27
14
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
4
1
IDS Classtypes
3
2
2
1
IDS Protocols
3
1
Detects Microsoft 365 token replay from the Huntress token spray and replay campaign. Alerts on sign-ins from an IP new to the account (not seen on 3 or more distinct days in the 14d baseline) that match one of three behaviors: a scripted client (node or bare Mozilla/5.0 user agent with Office or Authentication Broker client IDs), Device Registration Service access (Medium-High only when corroborated by a campaign IP, scripted user agent or session IP hop, otherwise Low), or one session moving across IPs within 60 minutes. Rows are raised to High when the same new IP hits 3 or more baseline accounts in the window (token spray pattern) or matches a campaign IOC. Low Signal rows are dropped when AlertOnly = true. Does not cover MFA changes, device registration events or inbox rules.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
This rule monitors Entra ID (Azure AD) SAML sign-in events and correlates them with on-premises Active Directory Federation Services (AD FS) audit logs. It specifically looks for indicators of forged SAML tokens, including sign-in events without a corresponding upstream authentication, SAML tokens with excessively long lifetimes, or authentication activity following a recent update to the AD FS token-signing certificate, which is a hallmark of the Golden SAML technique.
This rule monitors Azure Active Directory service principal sign-in logs to identify authentication attempts from countries or Autonomous System Numbers (ASNs) that have not been observed in the entity's 14-day historical baseline. Such anomalous login behavior may indicate potential account compromise, token theft, or unauthorized use of service principal credentials.
Detects potential credential reuse attacks such as Pass-the-Hash, Pass-the-Ticket, or Overpass-the-Hash. The rule identifies a 'NewCredentials' logon (e.g., runas /netonly) followed by a network or remote interactive logon to a target system (such as a domain controller) by the same user, without an interactive logon session occurring between the events, which is indicative of using stolen credentials to move laterally.
This rule detects potential NTLM relay or authentication downgrade attempts by monitoring HTTP POST requests to the Certificate Enrollment Service (CES) endpoint. It specifically flags when an 'Authorization' header contains an NTLM-wrapped 'Negotiate' token, which is often indicative of an attacker attempting to coerce or relay authentication material to the service.
Detects potential credential reuse attacks such as Pass-the-Hash, Pass-the-Ticket, or Overpass-the-Hash. The rule identifies a 'NewCredentials' logon (e.g., runas /netonly) followed by a network or remote interactive logon to a target system (such as a domain controller) by the same user, without an interactive logon session occurring between the events, which is indicative of using stolen credentials to move laterally.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects anomalous authentication patterns where a user account accesses a large number of distinct SaaS/SSO resources within a short time frame from devices or IP addresses not previously associated with the user's historical baseline. This behavior is indicative of a stolen session cookie being replayed by an adversary to perform rapid lateral movement across the victim's cloud footprint.
Detects non-interactive sign-in events in Entra ID that occur without a preceding interactive sign-in session on the same device that successfully satisfied a multi-factor authentication (MFA) challenge. This behavior is indicative of token replay attacks or session hijacking where an adversary attempts to use harvested session cookies or tokens to access resources.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects successful remote authentication events (Network or Interactive) performed by AI agent orchestration service accounts. This rule monitors for atypical lateral movement patterns where an automated service account pivots to remote hosts using protocols such as RDP or WinRM, diverging from its standard operational context.
Detects suspicious AI inference API activity indicative of credential compromise or misuse. The rule identifies three main signals: rapid authentication failures (credential stuffing), anomalous geolocation/ASN usage for successful requests, and successful API calls occurring after a key rotation event.
Detects unauthorized modifications to the Entra ID authentication methods policy or suspicious application activity often associated with the staging of rogue External Authentication Methods (EAM). Adversaries may exploit these configuration changes to intercept or bypass multi-factor authentication (MFA) during user login processes.
Detects the granting of tenant-wide admin consent for 'openid' and 'profile' scopes to 'AllPrincipals' within an Azure environment. This activity is indicative of the final stage in a TrustSink or similar rogue External Authentication Method (EAM) attack, where an adversary configures an application to bypass user consent prompts for sensitive identity scopes.
Detects potential credential reuse attacks such as Pass-the-Hash, Pass-the-Ticket, or Overpass-the-Hash. The rule identifies a 'NewCredentials' logon (e.g., runas /netonly) followed by a network or remote interactive logon to a target system (such as a domain controller) by the same user, without an interactive logon session occurring between the events, which is indicative of using stolen credentials to move laterally.
Page 1 of 9