Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
276
67
44
26
23
Contributors
167
111
62
17
9
Categories
238
219
140
83
78
Platforms
338
217
143
29
23
Products / Services
286
157
50
38
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
13
5
3
2
1
IDS Classtypes
5
3
2
IDS Protocols
9
This rule detects modifications to Azure Service Principal and Application object redirect URIs that match known patterns for reverse proxies, tunneling services, temporary callback infrastructure, or potential local token theft. Such changes may indicate an adversary attempting to establish persistent access, intercept authentication tokens, or bypass network controls via unauthorized application configurations.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects HTTP POST requests to the Microsoft login endpoint for OAuth2 tokens using the client_credentials grant type, where the request body contains evidence of hardcoded client_secret parameters and specific scopes. This behavior often indicates an application or script with embedded, potentially leaked or insecurely stored, credentials being used to authenticate against Microsoft cloud services.
Detects network requests to the Google OAuth device authorization flow endpoint, which is commonly abused in phishing campaigns to trick users into authorizing a malicious application on their behalf, allowing an attacker to steal session tokens.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects network requests to the Google OAuth device authorization flow endpoint, which is commonly abused in phishing campaigns to trick users into authorizing a malicious application on their behalf, allowing an attacker to steal session tokens.
This rule detects non-interactive sign-in events involving the 'Microsoft Authentication Broker' where the authentication was performed using only single-factor authentication and originated from a device that is not recognized or lacks trust information (unmanaged/unknown device). This pattern is consistent with token replay attacks or session hijacking, where an adversary uses stolen authentication artifacts to access resources without undergoing standard multi-factor authentication.
Detects anomalous sign-in behavior where a single unique token identifier is used from multiple IP addresses, countries, or devices within a short timeframe (less than one hour). This pattern is often indicative of session token theft, where an adversary uses an exfiltrated token to authenticate from a different location or device, bypassing standard credential-based authentication.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects sign-in events where a sign-in attempt is performed with a valid application ID but contains a blank application name, indicating potential spoofing of an OAuth client to bypass Conditional Access policies. The rule specifically monitors instances where Conditional Access status is recorded as 'notApplied'.
Detects potential misuse of an Azure Managed Identity token on a Linux host, where 'curl' is used to interact with the Azure Key Vault API (vault.azure.net/secrets) while presenting an Authorization bearer token. This pattern can indicate an adversary who has obtained a Managed Identity token (e.g., via the Instance Metadata Service) and is attempting to exfiltrate or access sensitive secrets stored in Azure Key Vault.
ARTokenC2NetworkTraffic - fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform.
Detects email notifications regarding the addition of a new Personal Access Token (PAT) to a GitHub account. This activity is often a precursor to unauthorized API access if an adversary has compromised a user's account.
Detects sign-in attempts where the OAuth Client ID (AppId) does not have a corresponding display name (AppDisplayName) in the logs, and the same Client ID is observed across multiple different Azure tenants. This pattern often indicates an adversary using a malicious or spoofed OAuth application to perform multi-tenant abuse, consent phishing, or unauthorized access across different organizational boundaries.
Correlates a Microsoft 365 OAuth device-code authentication event with subsequent impact actions on the same identity (device registration/PRT setup, inbox rule creation, or PRT/sign-in activity after a password reset) within a 1-hour window. Severity escalates as more distinct impact phases co-occur on the same actor, consistent with ARToken/EvilTokens post-device-code-phishing persistence chains.
Detects an authentication event using the OAuth 2.0 Device Code grant flow, immediately followed by rapid access to multiple high-value cloud resources. This pattern is characteristic of consent phishing or device code phishing, where an adversary tricks a user into authorizing a malicious application, subsequently using that application's access token to programmatically enumerate or exfiltrate data from various services.
Detects the execution of the roadtx command-line utility, which is a component of the ROADtools framework used for OAuth device code flow interaction and token acquisition within Entra ID (formerly Azure AD) environments.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects failed authentication attempts using the BAV2ROPC user agent (Azure CLI / legacy OAuth2 ROPC token requests) in Microsoft 365 Unified Audit Logs. BAV2ROPC bypasses MFA by authenticating directly to the /token endpoint. Error codes 50053 (account lockout), 50126 (invalid credentials), and 50034 (user not found) are characteristic of password spraying activity. Observed in the LSHIY LLC password spray campaign (June 2026).
This rule detects the use of the OAuth 2.0 Device Code Authorization flow directed towards 'microsoft.com/devicelogin'. This authentication method is frequently abused by attackers in phishing campaigns to hijack device-based user sessions by tricking victims into entering a device code on a malicious site, effectively bypassing traditional password-based authentication.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Page 16 of 22