Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
181 detections
Filters
Last updated
All Time
Detection languages
114
27
13
10
5
Contributors
63
37
19
10
5
Categories
67
53
53
44
40
Platforms
81
80
40
28
15
Products / Services
63
40
32
27
14
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
4
1
IDS Classtypes
3
2
2
1
IDS Protocols
3
1
Detects potential credential reuse attacks such as Pass-the-Hash, Pass-the-Ticket, or Overpass-the-Hash. The rule identifies a 'NewCredentials' logon (e.g., runas /netonly) followed by a network or remote interactive logon to a target system (such as a domain controller) by the same user, without an interactive logon session occurring between the events, which is indicative of using stolen credentials to move laterally.
Detects Azure AD/Entra ID sign-ins performed using the OAuth device-code flow, excluding common administrative tools like the Azure CLI or PowerShell. This flow is frequently abused in phishing campaigns (such as EvilTokens or ARToken) where attackers entice victims to enter a device code into a malicious application, allowing the attacker to gain authorized access to the victim's session.
Detects sign-in events using the OAuth 2.0 device code flow, which is a mechanism often abused in phishing campaigns (such as GhostCode) to lure users into authorizing malicious applications or granting access tokens without needing their actual credentials.
Detects modifications to Microsoft Entra authentication policy or external authentication method configurations, which may indicate an adversary attempting to establish a 'TrustSink' or alternate authentication persistence mechanism by registering a malicious OIDC provider or modifying authentication policy.
Detects potential credential reuse attacks such as Pass-the-Hash, Pass-the-Ticket, or Overpass-the-Hash. The rule identifies a 'NewCredentials' logon (e.g., runas /netonly) followed by a network or remote interactive logon to a target system (such as a domain controller) by the same user, without an interactive logon session occurring between the events, which is indicative of using stolen credentials to move laterally.
Detects high-risk administrative actions in Microsoft 365, such as new MFA method registration, OAuth app consent grants, or email forwarding rule creation, occurring in sessions that lack fresh authentication (often indicative of a session-cookie replay attack).
Detects anomalous sign-in attempts to the OfficeHome application that result in OAuth error 90014 (frequently associated with application access issues or invalid consent) combined with an implausible mismatch between the reported Windows 10 operating system and mobile-specific browser user agents (e.g., Mobile Safari, Chrome Mobile). This behavior may indicate an adversary attempting to mimic legitimate device traffic to bypass conditional access policies or facilitate OAuth-based token manipulation.
Detects sign-in events using the OAuth 2.0 device code flow, which is a mechanism often abused in phishing campaigns (such as GhostCode) to lure users into authorizing malicious applications or granting access tokens without needing their actual credentials.
This rule captures all successful login events to serve as the foundational data source for downstream correlation engines. It is designed to identify suspicious patterns such as credential reuse across disparate IP addresses, anomalous device fingerprints following MFA, or account logins shortly after phishing visits. This filter acts as a raw event provider for more complex logic that cannot be evaluated within a single-event context.
Detects instances where the device code authentication protocol is utilized. This protocol is commonly used for headless devices, but is also frequently abused by adversaries for phishing and device code flow abuse to acquire unauthorized access tokens.
This rule detects successful or attempted sign-ins to Microsoft Entra ID using the OAuth 2.0 device authorization grant flow. This specific authentication flow is increasingly leveraged by adversaries in passkey-themed phishing campaigns to obtain valid access and refresh tokens without requiring direct credential or cookie theft. By monitoring for this protocol usage, security teams can identify potential attempts to bypass traditional authentication mechanisms.
Detects successful Microsoft Intune enrollment events initiated using the Device Code authentication protocol in Azure AD/Entra ID. This flow is often abused by adversaries to perform OAuth device code phishing, allowing them to gain unauthorized access to cloud resources by tricking users into authorizing a malicious application on their own devices.
This rule identifies successful user sign-ins (ResultType 0) originating from specific Autonomous System Numbers (197540, 216154) where Multi-Factor Authentication (MFA) was not required or not recorded, and where Conditional Access policies either did not apply or succeeded without enforcing MFA.
Detects authentication failures in Microsoft Entra ID associated with external MFA providers. This condition, specifically indicated by failure codes 70002 or 50012 and associated error messages regarding signature validation or external token trust, may indicate an attempt to bypass authentication via a rogue MFA provider or a misconfigured integration.
Detects high-frequency authentication failures in Entra ID (Azure AD) originating from External Authentication Method (EAM) providers. The rule identifies instances where the external identity token fails signature or key-ID validation (AADSTS50012/AADSTS70002), which may indicate configuration issues with the external IdP or attempts to forge authentication tokens.
Detects high-frequency authentication failures in Entra ID (Azure AD) originating from External Authentication Method (EAM) providers. The rule identifies instances where the external identity token fails signature or key-ID validation (AADSTS50012/AADSTS70002), which may indicate configuration issues with the external IdP or attempts to forge authentication tokens.
This rule identifies successful user sign-ins (ResultType 0) originating from specific Autonomous System Numbers (197540, 216154) where Multi-Factor Authentication (MFA) was not required or not recorded, and where Conditional Access policies either did not apply or succeeded without enforcing MFA.
Detects sign-in activity using pre-existing durable session tokens (e.g., PRT, broker-based tokens) that occur shortly after a password reset, suggesting that the adversary has maintained persistent access despite the credential change.
Detects a suspicious sequence of events where a user initiates a device code authorization flow, immediately followed by a Microsoft Authentication Broker sign-in using the 'sso_reload=true' parameter. This pattern is indicative of an attacker hijacking the device code authorization process to gain unauthorized access to a user's session.
Detects instances where a LiteLLM proxy is utilized to invoke sensitive Model Context Protocol (MCP) tools (e.g., database, github, slack, jira, ci/cd) while authentication is bypassed ('allow_all_keys=true') and no explicit API key is provided. This indicates a potential unauthorized access attempt to sensitive integrations via a misconfigured proxy.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Page 2 of 9