Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
170 detections
Filters
Last updated
All Time
Detection languages
64
46
20
18
12
Contributors
36
23
19
13
12
Categories
59
42
39
38
36
Platforms
74
43
24
22
18
Products / Services
42
36
33
13
10
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
7
2
2
2
1
IDS Classtypes
4
4
3
3
1
IDS Protocols
7
5
Detects the addition of a new strong authentication method (MFA/authenticator device) to an account. This activity is a common indicator of persistence following a successful AiTM (Adversary-in-the-Middle) phishing attack or initial account compromise, as attackers establish their own MFA device to maintain long-term access.
This rule detects the creation or modification of specific files ('auth_codes.json' or files containing 'seria2') associated with the offline recovery process of Dahua devices. The presence of these files suggests an attempt to utilize or access deterministic recovery codes to bypass authentication on the device.
Detects Azure AD sign-in events where Multi-Factor Authentication (MFA) was reportedly satisfied by an External Authentication Method (EAM) claim without evidence of a traditional secondary authentication challenge. This behavior is indicative of a 'TrustSink' technique where a rogue or compromised OIDC provider injects a spoofed assertion of MFA success into the authentication token.
Detects Azure AD sign-in events where Multi-Factor Authentication (MFA) was reportedly satisfied by an External Authentication Method (EAM) claim without evidence of a traditional secondary authentication challenge. This behavior is indicative of a 'TrustSink' technique where a rogue or compromised OIDC provider injects a spoofed assertion of MFA success into the authentication token.
Detects a suspicious sequence of events where a user modifies the Entra Authentication Methods Policy to register an external authentication method (EAM) provider, followed immediately by the same user associating a new FIDO key with their account. This behavior can be indicative of an adversary setting up a persistence mechanism via a malicious or unauthorized MFA provider.
Detects a suspicious sequence of events where a user modifies the Entra Authentication Methods Policy to register an external authentication method (EAM) provider, followed immediately by the same user associating a new FIDO key with their account. This behavior can be indicative of an adversary setting up a persistence mechanism via a malicious or unauthorized MFA provider.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects a multi-stage cloud attack sequence involving a sign-in anomaly, modification of user authentication methods (e.g., registering an attacker-controlled device), reconnaissance using Microsoft Graph API, and subsequent abnormal data access/download, typically observed in Storm-3121 and Storm-3032 activities.
Detects changes to user authentication methods, such as activating software tokens, registering new security information, or changing MFA configuration. This activity can indicate an adversary attempting to modify MFA settings to maintain persistent access or bypass account security controls.
KQL Query from file: postgresql-pghbaconf-trust-auth-backdoor-enabling-passwordless-logins.kql
Detects modifications to a user's Azure Active Directory (Entra ID) account involving the addition of a new MFA authentication method or device, such as software tokens or mobile devices. This activity is often performed by an adversary to establish persistence by registering a device they control for future authentication bypass.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
This rule detects the use of 'osascript' on macOS to generate a fake credential prompt dialog. It specifically looks for AppleScript commands containing keywords such as 'display dialog', 'password', and either 'with hidden answer' or 'Enter your password'. This behavior is characteristic of an adversary attempting to phish user credentials by presenting a legitimate-looking prompt.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
Detects instances where a user who has not enrolled in Duo MFA successfully authenticates due to being connected to a defined trusted network. This behavior indicates an MFA coverage gap, potentially allowing an attacker to authenticate as an unenrolled user without MFA if they gain access to a trusted network or VPN.
Detects abuse of Google Cloud Authenticator device-management API calls associated with the Pass-ta-key attack, where an attacker-controlled key is introduced or a device is de-registered without a legitimate biometric/attestation ceremony. Covers device/register with keys/genpair, device/add_uv_key, and device/forget commands observed in cloud authenticator device-management event logs. To reduce false positives, device/add_uv_key and device/forget calls only alert when they lack an associated preceding hardware attestation or biometric ceremony event, and legitimate user-initiated new-device enrollment (following a known legitimate sign-in with a prior MFA/biometric ceremony on the requesting device) and legitimate account-recovery flows are excluded.
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Page 3 of 9