Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
170 detections
Filters
Last updated
All Time
Detection languages
64
46
20
18
12
Contributors
36
23
19
13
12
Categories
59
42
39
38
36
Platforms
74
43
24
22
18
Products / Services
42
36
33
13
10
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
7
2
2
2
1
IDS Classtypes
4
4
3
3
1
IDS Protocols
7
5
This rule detects a sequence of events indicative of MacSync credential phishing on macOS. It identifies the tampering of Pluggable Authentication Modules (PAM) configuration files or SecurityAgent plugins (often used to hook authentication processes), immediately followed by the use of osascript to display a spoofed password dialog to the user. This combined activity suggests an adversary is attempting to harvest local user account credentials.
Detects instances where an administrative user performs a password or MFA method reset on a target account, followed within 24 hours by a sign-in event from that same target account flagged with a high or medium risk level. This sequence is characteristic of Adversary-in-the-Middle (AiTM) attacks, where an attacker utilizes stolen session tokens and subsequently coerces helpdesk or administrative intervention to reset MFA requirements to maintain unauthorized access.
Detects requests to the FedCM (Federated Credential Management) well-known configuration endpoint (.well-known/web-identity) that originate from referrers containing 'gusercontent.com', often used in phishing or credential harvesting campaigns to simulate legitimate Google authentication flows.
Detects sign-in events where an external authentication provider is used to fulfill a multi-factor authentication requirement while simultaneously asserting a 'hardware-key' (hwk) claim. This behavior is indicative of an adversary abusing a rogue or misconfigured external MFA provider to forge authentication claims and bypass security controls.
Detects modifications or additions to Conditional Access policies or External Authentication Methods in Azure AD/Entra ID. These changes could be indicative of an adversary attempting to bypass multi-factor authentication or establish persistence by weakening authentication controls.
Detects an attempt to bypass SharePoint authentication using a 'Register' directive in a POST request body directed at an .aspx page that is not a recognized ToolPane page. This pattern is indicative of an exploit attempt against a public-facing SharePoint server, specifically targeting vulnerability CVE-2026-65660.
Detects a suspicious sequence of events where a user modifies the Entra Authentication Methods Policy to register an external authentication method (EAM) provider, followed immediately by the same user associating a new FIDO key with their account. This behavior can be indicative of an adversary setting up a persistence mechanism via a malicious or unauthorized MFA provider.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication policies, specifically the registration, enablement, or modification of External Authentication Methods (EAMs). This activity can indicate an attempt to add a rogue authentication provider for persistent unauthorized access, bypassing standard MFA or conditional access policies.
Detects user sign-ins that utilize an 'External Authentication Method' within 3 days of a password reset event. This behavior may indicate an adversary has successfully established persistence using a rogue authentication provider (e.g., via a TrustSink or similar malicious configuration) that survives password remediation and is capable of capturing or intercepting subsequent authentication tokens.
Detects Azure AD sign-in events where Multi-Factor Authentication (MFA) was reportedly satisfied by an External Authentication Method (EAM) claim without evidence of a traditional secondary authentication challenge. This behavior is indicative of a 'TrustSink' technique where a rogue or compromised OIDC provider injects a spoofed assertion of MFA success into the authentication token.
Detects the enrollment of a new security key or passkey shortly after an unfamiliar or suspicious sign-in event within Google Workspace. This behavior is indicative of an adversary establishing persistent access following a successful session hijack or credential phishing campaign, specifically targeting authentication mechanisms to bypass existing security controls.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule detects a specific network exploit attempt targeting Dahua devices (CVE-2021-33045), where an attacker attempts to bypass authentication by manipulating the login parameters, specifically by forcing the system to interpret requests as coming from the local loopback interface.
This rule detects an attempt to exploit CVE-2021-33045, an authentication bypass vulnerability in certain Dahua products. An attacker can bypass authentication by sending a crafted HTTP POST request to the application, specifically using a loopback authentication type with a local IP address (127.0.0.1) in the login payload.
Detects a suspicious sequence of events where a user modifies the Entra Authentication Methods Policy to register an external authentication method (EAM) provider, followed immediately by the same user associating a new FIDO key with their account. This behavior can be indicative of an adversary setting up a persistence mechanism via a malicious or unauthorized MFA provider.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects network traffic attempting to exploit CVE-2021-33044 in Dahua NetKeyboard devices. The rule identifies specifically crafted 'global.login' requests designed to bypass authentication mechanisms.
This rule detects a sequence of events where a database user record is updated (inserting a new password hash) followed by a successful authentication for that same user, immediately following a recent login failure. This pattern is indicative of an attacker modifying credentials and then testing the new access.
Page 2 of 9