Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
276
67
44
26
23
Contributors
167
111
62
17
9
Categories
238
219
140
83
78
Platforms
338
217
143
29
23
Products / Services
286
157
50
38
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
13
5
3
2
1
IDS Classtypes
5
3
2
IDS Protocols
9
Detects instances where a user grants OAuth application permissions to an unverified third-party application. The rule specifically monitors for high-privilege scopes such as Mail.Read, Files.ReadWrite.All, or full_access_as_app, which are commonly abused in illicit consent grant attacks to achieve persistent access to sensitive mailbox and cloud data.
Detects anomalous use of an AI agent session or OAuth token from multiple distinct IP addresses, hostnames, or user-agents within a short 10-minute window. This behavior is highly indicative of token theft and replay, where an adversary attempts to use a compromised session token from a different location or environment.
Detects Azure AD sign-in events indicative of 'EvilTokens' phishing-as-a-service tradecraft. The rule monitors for initial token-grant events (device-code authentication or OAuth application consent) and subsequent successful sign-ins using existing SessionIds. This rule is designed as a foundational detection component for identifying session token replay, which allows adversaries to bypass MFA and password requirements by hijacking valid session tokens.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
Detects potential refresh token replay attacks, such as those facilitated by Adversary-in-the-Middle (AiTM) proxy phishing, by identifying consecutive non-interactive sign-in events for the same user from geographically distant locations within a short time frame that precludes physical travel.
Detects sign-in activity using refresh tokens from device details (deviceId, browser, OS) that have not been previously observed for the user. This pattern is indicative of session token theft, often associated with Adversary-in-the-Middle (AiTM) phishing kits where attackers replay stolen session or refresh tokens to bypass multi-factor authentication.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
This rule identifies potential account compromise through the detection of non-interactive Azure AD sign-ins originating from geographically distant locations within a short, travel-implausible timeframe. Such activity is highly indicative of the theft and export of a Primary Refresh Token (PRT) from a legitimate endpoint, which is subsequently replayed by an adversary from external infrastructure to gain unauthorized access to cloud resources.
Detects a potential Primary Refresh Token (PRT) or device code phishing attack by identifying a two-step authentication sequence: first, a successful user sign-in via device code flow, followed shortly by a subsequent sign-in from a different, unmanaged, or untrusted device. This behavioral pattern often indicates an adversary using stolen device code session data to authenticate a new device session.
This rule detects the reuse of the same user's refresh token from two different countries within a 15-minute window. This behavior is a strong indicator of token theft or session hijacking, commonly associated with AiTM phishing, infostealer malware, or session cookie extraction, where an adversary uses stolen credentials from a remote location.
This rule detects potential account compromise by identifying 'impossible travel' scenarios where successful logins for the same user occur from different geolocations within a short timeframe (less than 1 hour), specifically when at least one authentication event uses a refresh or session token rather than interactive MFA. It correlates these suspicious logins with previous endpoint infostealer detections on the same device within the last 72 hours, indicating that the token may have been stolen by malware.
Detects non-interactive sign-in events where a refresh token is used to authenticate without satisfying a multi-factor authentication (MFA) requirement. This pattern is indicative of potential token theft and replay attacks, where an adversary uses a stolen refresh token to maintain persistence or access resources without triggering the expected MFA prompt.
Detects anomalous sign-in behavior, including impossible travel (geo-velocity) and non-interactive authentication without MFA, specifically targeting patterns indicative of Adversary-in-the-Middle (AiTM) session token theft.
Detects anomalous authentication behavior consistent with Adversary-in-the-Middle (AiTM) phishing attacks, specifically where an MFA-authenticated session is accessed from multiple, disjoint geographic locations or IP addresses within a short timeframe, indicating the replay of stolen session tokens.
Detects OAuth2 authorization code flow attempts in Entra ID (Azure AD) sign-in logs where the redirect URI is external to the Microsoft ecosystem, followed by an immediate token issuance event to that same suspicious endpoint. This behavior is indicative of 'ClickFix' or 'ConsentFix' phishing attacks, where users are manipulated into copying an authorization code from a legitimate Microsoft sign-in prompt and pasting it into an attacker-controlled application.
Detects anomalous sign-in behavior where the same Entra ID session or refresh token is reused from two geographically distant IP addresses within a short timeframe. This activity is correlated with a prior suspicious OAuth consent-grant or device-code authentication event on the same account, which is a common indicator of an 'EvilTokens' style session-token replay attack.
Detects exploitation attempts against CVE-2026-55040 on Microsoft SharePoint Server. This vulnerability allows an attacker to bypass authentication by sending a malformed JSON Web Token (JWT) with an 'alg: none' header or an empty signature. The SharePoint server incorrectly trusts the provided token, enabling unauthorized access to sensitive API and SOAP endpoints.
Detects Azure sign-in events claiming successful hardware-key or FIDO2 authentication where the authentication issuer is not part of a known-good allow-list. This behavior is indicative of a rogue MFA provider, such as the TrustSink attack, which issues forged tokens claiming MFA requirements were satisfied.
Detects a suspicious pattern where a user authenticates via device code and, within a short timeframe (two hours), registers a new device to their account. This behavior is indicative of the 'ARToken' persistence pattern, where an adversary uses a stolen session to bind a rogue device to the victim's account, potentially to mint a Primary Refresh Token (PRT) for persistent access.
This rule detects scenarios where a user completes a device-code authentication flow, followed immediately (within 10 minutes) by the registration of an unmanaged, non-compliant device to their account. This behavior is indicative of potential token theft (e.g., EvilTokens) where an adversary uses a stolen token to register their own device as a persistent, unmanaged entity, bypassing standard corporate device enrollment controls.
Page 2 of 22