Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
181 detections
Filters
Last updated
All Time
Detection languages
114
27
13
10
5
Contributors
63
37
19
10
5
Categories
67
53
53
44
40
Platforms
81
80
40
28
15
Products / Services
63
40
32
27
14
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
4
1
IDS Classtypes
3
2
2
1
IDS Protocols
3
1
Detects a non-interactive sign-in using an existing session shortly after the user completes interactive MFA, which can indicate stolen token replay. This rule identifies scenarios where a user successfully completes an interactive multi-factor authentication (MFA) sign-in, and then, within a short time frame (1800 seconds or 30 minutes), a non-interactive sign-in occurs for the same user and session ID. This pattern is indicative of a stolen session token being replayed by an attacker, bypassing subsequent MFA prompts.
This rule detects potential Conditional Access bypass attempts where a Primary Refresh Token (PRT) is exchanged for an Azure Active Directory (AAD) Graph token. The detection specifically looks for successful sign-ins to 'Windows Azure Active Directory' or 'Microsoft Graph' resources from devices marked as 'compliant' but with 'Unknown' ownership or no prior device registration history in Audit Logs. This could indicate an adversary using a compromised PRT on an unregistered or untrusted device to gain access to resources that should be protected by Conditional Access policies.
This rule detects attempts to bypass Conditional Access policies by exchanging a Primary Refresh Token (PRT) for an Azure Active Directory (AAD) Graph token on a device that is either of 'Unknown' ownership or lacks a check-in history, despite being marked as compliant. This behavior could indicate an adversary attempting to gain unauthorized access to resources by leveraging a compromised PRT on an unmanaged or suspicious device, circumventing Conditional Access controls.
Detects session hijacking attempts where a session cookie is used from a different IP address or user-agent immediately following a successful MFA authentication event. This behavior is indicative of an adversary replaying a stolen session token.
This rule correlates three distinct events to detect a potential credential theft and lateral movement chain: an LSASS credential dump, followed by an NTLM network logon, and then a DCOM activation of mmc.exe with the '-Embedding' flag on the target system. This sequence of events is indicative of an attacker compromising credentials, using them to move laterally, and then potentially executing further commands or tools via DCOM.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects successful non-interactive token acquisitions using specific Microsoft first-party application IDs known to bypass Entra Conditional Access Policies through Nested App Authentication (NAA/BroCI). The detection specifically targets sign-ins to the Microsoft Graph resource.
Detects a Google account completing an OAuth or MFA challenge and then generating a new session from a different client fingerprint (different source IP or user agent) within a 10-minute window. This behavior can indicate a session hijack or an adversary bypassing MFA.
Detects a non-interactive sign-in using an existing session shortly after the user completes interactive MFA, which can indicate stolen token replay. This rule identifies scenarios where a user successfully completes an interactive multi-factor authentication (MFA) sign-in, and then, within a short time frame (1800 seconds or 30 minutes), a non-interactive sign-in occurs for the same user and session ID. This pattern is indicative of a stolen session token being replayed by an attacker, bypassing subsequent MFA prompts.
Detects a session issued through browser MFA and subsequently used through a non-interactive, mobile, or command-line client. This behavior is indicative of an adversary potentially using a stolen session token to bypass multi-factor authentication.
Detects successful non-interactive token acquisitions using specific Microsoft first-party application IDs known to bypass Entra Conditional Access Policies through Nested App Authentication (NAA/BroCI). The detection specifically targets sign-ins to the Microsoft Graph resource.
Detects sign-ins to M365 using the default Node.js user agent, indicative of the Tycoon 2FA kit relay tier.
Detects use of forged web credentials for unauthorized application access
This rule detects potential lateral movement attempts using alternate authentication material, specifically NTLMSSP, over SMB (port 445). It triggers an alert if five or more NTLMSSP authentications are observed from a single source IP address to the home network within a 30-second window. This behavior can indicate an attacker attempting to authenticate to multiple systems using stolen credentials or hashes.
Detects post-install execution of the TeamPCP-compromised Microsoft durabletask package
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
Detects when OAuth applications are added to trusted lists or granted Context-Aware Access (CAA) exemptions within Google Workspace. This activity bypasses user consent screens and CAA policies, potentially allowing malicious applications to gain unauthorized access. The rule also tracks permission escalation for existing applications via 'CHANGE_APP_ACCESS' events.
This rule detects suspicious execution of AADConnect synchronization processes (ADSync.exe or Microsoft.Azure.AD.Sync.exe) that are not initiated by the services.exe parent process or do not contain 'scheduled' in their command line. This pattern could indicate an attacker attempting to manipulate or leverage AADConnect for privilege escalation or lateral movement between on-premises and cloud environments, as observed in Silk Typhoon activity.
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.
Detects logon events that specify new credentials
Page 7 of 9