Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
158 detections
Filters
Last updated
All Time
Detection languages
93
25
16
9
7
Contributors
75
40
10
6
5
Categories
105
50
44
39
34
Platforms
94
93
51
13
10
Products / Services
104
53
19
15
11
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
1
1
IDS Protocols
2
Detects potential session hijacking of a Claude SaaS account by identifying sign-ins from unrecognized IP addresses followed by a high-volume burst of API usage or message activity that deviates from the account's established baseline.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by identifying a sequence where a user experiences a sign-in interruption (ResultType 50199) followed by a successful sign-in with the same SessionId but from a different, anomalous User-Agent (typically associated with automated tools like Axios). This pattern indicates the reuse of intercepted session tokens to bypass multi-factor authentication.
Detects non-interactive sign-in events to common Microsoft 365 applications (OfficeHome, Outlook, My Sign-Ins, My Profile) where the User-Agent identifies as an automated HTTP client library (Axios or Python-requests). This behavior is often indicative of programmatic access via stolen session cookies or application tokens, commonly seen in adversary activity such as payroll-related business email compromise.
Detects OfficeHome sign-in events featuring the 90014 error code (missing OAuth nonce). The rule looks for a specific mismatch where mobile browser User Agents are observed on a system reported as Windows 10, a pattern consistent with Adversary-in-the-Middle (AiTM) session token replay attacks attempting to access Microsoft 365 environments.
Detects anomalous Microsoft 365 session behavior where a single SessionId persists across multiple sign-ins that originate from rotating IP addresses and ASNs. The detection identifies signs of potential session token theft, specifically looking for traffic matching the Microsoft Outlook client app signature paired with non-standard user agents (e.g., Firefox or Python requests) that exhibit recurring sign-in attempts at approximately 8-hour intervals, which is typical for automated token refresh cycles.
Detects anomalous sign-in activity where a single Microsoft 365 or Entra ID user account successfully authenticates from multiple distinct residential or mobile-carrier ASNs within a 24-hour window. This behavior is highly indicative of an adversary replaying stolen session tokens (AiTM) through rotating residential proxy networks to blend into legitimate user traffic and circumvent location-based or datacenter IP-based access restrictions.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects anomalous authentication patterns in Microsoft 365 logs where a valid session is utilized across multiple distinct devices within a short timeframe (under 5 minutes) without a corresponding multi-factor authentication (MFA) challenge. This behavior is indicative of a session token replay attack, where an adversary uses a stolen session cookie to bypass MFA and access cloud services.
This rule detects potential unauthorized access to the 'My Sign-Ins' portal in Azure AD by monitoring for logins associated with multiple unique source IP addresses or Autonomous System Numbers (ASNs) for a single user account. This behavior is indicative of session hijacking or account compromise where an adversary is accessing the account from a different network than the legitimate user.
This rule detects non-interactive authentication attempts to key development and collaboration platforms (e.g., GitHub, GitLab, Slack, Azure DevOps) from IP addresses or locations that have not been observed in the user's interactive sign-in history over the past 14 days. This behavior is indicative of potential session or refresh token theft, where an adversary replays stolen browser cookies from a different infrastructure to bypass traditional authentication.
Detects a suspicious authentication pattern involving 3 or more MFA failures within 15 minutes, immediately followed by an MFA success for the same user. This pattern is characteristic of potential Adversary-in-the-Middle (AiTM) activity, where an attacker intercepts a session or MFA token and relays it through separate infrastructure, while the legitimate user's own MFA attempts fail or time out.
Detects OfficeHome sign-in events featuring the 90014 error code (missing OAuth nonce). The rule looks for a specific mismatch where mobile browser User Agents are observed on a system reported as Windows 10, a pattern consistent with Adversary-in-the-Middle (AiTM) session token replay attacks attempting to access Microsoft 365 environments.
Detects Microsoft 365 / Entra ID sign-in events where the reported client application is Microsoft Outlook but the User-Agent string is inconsistent with Outlook's standard Edge-based WebView. This behavioral discrepancy often indicates the use of automated HTTP clients to replay stolen session tokens in Adversary-in-the-Middle (AiTM) phishing campaigns, allowing attackers to maintain authenticated access for reconnaissance and data collection.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects unauthorized access to critical browser files such as cookies, login data, and local state files. These files contain sensitive information such as authentication cookies and stored credentials, which are primary targets for infostealer malware.
Detects potential cross-application SSO session or token reuse by identifying users transitioning from a low-trust application (forum) to a high-trust application (ChatGPT/Codex) within a short window (15 minutes), especially when the sign-in is non-interactive (lacking MFA) or occurs from a different IP address or user agent, suggesting a possible token replay attack.
Detects potential cross-application SSO session or token reuse by identifying users transitioning from a low-trust application (forum) to a high-trust application (ChatGPT/Codex) within a short window (15 minutes), especially when the sign-in is non-interactive (lacking MFA) or occurs from a different IP address or user agent, suggesting a possible token replay attack.
Detects unauthorized cloud authentication attempts in Azure AD where a session token appears to have been replayed. The rule identifies sign-ins flagged by Identity Protection as anomalous or involving token/issuer irregularities, particularly when these occur without a fresh MFA challenge, suggesting a bypass of standard authentication controls.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Page 4 of 8