Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
276
67
44
26
23
Contributors
167
111
62
17
9
Categories
238
219
140
83
78
Platforms
338
217
143
29
23
Products / Services
286
157
50
38
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
13
5
3
2
1
IDS Classtypes
5
3
2
IDS Protocols
9
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
This rule detects new or anomalous Google Workspace OAuth authorization events by monitoring for actions related to OAuth, consent, tokens, or authorization from IP addresses, geographical locations, or devices that have not been observed for the specific user account within the past 30 days.
This rule detects unauthorized requests to the '/api/tokens/import/txt' endpoint, which is associated with the 'Device Code Lab' token management panel. Such activity is indicative of an attacker importing stolen session tokens to maintain persistent access to a compromised environment.
This rule detects the creation of unauthorized technician accounts in the SimpleHelp RMM platform that follow an OIDC authentication bypass pattern (CVE-2026-48558). It correlates server logs indicating 'New Anon' registration activity with Windows Security Event ID 4720 (User account created), specifically filtering for accounts that do not belong to trusted corporate domains.
This rule detects suspicious Google OAuth authorization requests directed at accounts.google.com that utilize a local redirect URI (http://localhost) and are missing mandatory security parameters such as code_challenge, state, and login_hint. These characteristics are often associated with OAuth-based phishing or credential theft campaigns where an adversary attempts to intercept authorization codes.
This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.
Detects indicators of Device Code Lab's PRT Refresh capability, where an administrator's 'Revoke all sessions' (revokeSignInSessions) action is followed by a prt-refresh backend call that reactivates the attacker's session without new user interaction, bypassing standard OAuth refresh token revocation.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
Detects anomalous non-interactive OAuth token requests against Microsoft Graph that claim multi-factor authentication (MFA) satisfaction from unmanaged devices. This behavior is indicative of Adversary-in-the-Middle (AiTM) token replay attacks, where captured session tokens are reused by an attacker to bypass authentication controls, consistent with tactics used by threat actors like Storm-2755 (Payroll Pirate).
Detects OAuth consent grants or permission additions in Microsoft Entra ID (Azure AD) audit logs that occur in conjunction with device login flow artifacts. This pattern is indicative of 'ConsentFix' or device code phishing attacks, where users are manipulated into authorizing malicious applications, potentially bypassing MFA requirements by using the device code flow.
This rule detects potential session token theft or replay attacks by identifying non-interactive sign-in events that occur from a different IP or geographic location than the user's most recent successful MFA-authenticated interactive session. It flags cases where a non-interactive token is used within a short timeframe (1 hour) of an interactive session from a different location, which may indicate the exfiltration and subsequent use of session cookies or OAuth tokens.
Detects the presence of the 'x-ms-RefreshTokenCredential' cookie in requests directed to 'login.microsoftonline.com' originating from a client that does not identify as Windows. This behavioral pattern is associated with session hijacking techniques where an attacker uses a tool (e.g., Device Code Lab) to inject a session cookie into a browser, allowing for unauthorized access to Microsoft 365 services.
Detects evidence of CVE-2026-48558 exploitation, where SimpleHelp servers fail to cryptographically verify OIDC tokens. This vulnerability allows unauthenticated attackers to create privileged technician accounts and bypass Multi-Factor Authentication (MFA). The rule monitors for 'New Anon' log tags in OIDC authentication flows or unauthorized HTTP POST requests to SimpleHelp technician management endpoints.
This rule monitors Microsoft Entra ID (Azure AD) sign-ins for indicators associated with the 'Payroll Pirate' campaign. It identifies non-interactive OAuth/token-based authentication requests originating from residential Internet Service Provider (ISP) ASNs using devices marked as unmanaged. It further elevates risk by detecting impossible travel (same user accessing from multiple IPs in a short window) and the use of specific browser User-Agent strings (Firefox or Axios) characteristic of the threat actor's tooling.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
This rule detects potential post-compromise mailbox reconnaissance by correlating suspicious sign-in events (non-interactive or unmanaged device usage, often associated with AiTM token replay) with subsequent mailbox or compliance search operations targeting payroll and HR-related keywords within a 60-minute window.
This rule detects potential token theft or MFA bypass by correlating successful MFA-satisfied interactive sign-ins with subsequent non-interactive sign-ins (token refreshes) occurring within a 60-minute window from different IP addresses for the same user. This pattern is indicative of an attacker stealing a session token (e.g., via session cookie theft or AiTM phishing) and using it to authenticate from a different location.
This rule detects potentially malicious OAuth activity in Azure AD where a user performs a device code authentication flow, followed by a refresh token request from a different, anomalous IP address or geographical location. This behavior is indicative of an attacker who has successfully phished a device code from a user and is now attempting to maintain persistent access to the account via a stolen refresh token.
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
Page 17 of 22