Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
315 detections
Filters
Last updated
All Time
Detection languages
140
65
56
27
13
Contributors
116
51
30
16
13
Categories
94
93
89
75
71
Platforms
116
85
80
75
62
Products / Services
95
84
60
53
42
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
1
1
IDS Classtypes
32
31
1
1
1
IDS Protocols
41
13
2
2
1
Detects browser processes exhibiting a pattern consistent with 'Browser-in-the-Middle' attacks, specifically the streaming of DOM content (e.g., using rrweb) over persistent WebSocket connections to external IP addresses. The rule identifies high-density connection events to the same remote IP on port 443 lasting for more than 120 seconds and correlates these events with a preceding phishing email click on the same device.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
This rule detects network communication with infrastructure associated with the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth device code API endpoints (/api/device/*) hosted on workers.dev. This behavior is indicative of an adversary conducting device code phishing (a form of AitM attack) to obtain unauthorized access tokens.
Detects a spear-phishing email masquerading as AWS Support services originating from a specific compromised university account (awsservices@presby.edu). This rule identifies malicious emails associated with the PoisonSeeds AiTM (Adversary-in-the-Middle) phishing campaign, which uses support ticket lures to harvest credentials.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
Identifies login_verification events completing in less than 1 second, strongly indicative of automated AiTM proxying.
Detects device code authentication via Microsoft Authentication Broker targeting Microsoft Graph, which is a known indicator of Adversary-in-the-Middle (AiTM) attacks or device code phishing.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
Detects malicious script injection into HTTP responses via MitM
Detects malicious script injection into HTTP responses via MitM
Detects ARP cache poisoning attacks used for man-in-the-middle credential interception
Detects rogue DHCP server used for credential interception via DNS spoofing
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
This rule detects Address Resolution Protocol (ARP) spoofing attempts by looking for ARP reply packets (opcode 2) on the network. A threshold is applied to trigger an alert if 20 or more ARP replies are observed from the same source within a 10-second window, which is indicative of malicious ARP activity.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
Detects possible MFA-approved session replay by identifying abnormal reuse of authenticated sessions across multiple IPs, browsers, and devices compared against a 14-day historical baseline. The rule prioritizes browser/device anomalies over geography since modern attackers often use same-country VPS/proxies.
Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.
Detects abnormal MFA session behavior by monitoring user sessions with multiple IPs or browsers over 24h. Note: KQL 14-day historical baseline and set_difference logic is approximated.
Detects possible Adversary-in-the-Middle (AiTM) attacks, session cookie replay, MFA session hijacking, token theft, and stolen cloud session reuse by identifying abnormal SessionId reuse across multiple IPs, browsers, and devices. This detection compares current session activity against a 14-day historical user behavior baseline to identify new or abnormal behavior. It includes risk scoring and account classification, while reducing false positives from token refresh activity and common Microsoft Teams noise.
Page 12 of 15