Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
315 detections
Filters
Last updated
All Time
Detection languages
140
65
56
27
13
Contributors
116
51
30
16
13
Categories
94
93
89
75
71
Platforms
116
85
80
75
62
Products / Services
95
84
60
53
42
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
1
1
IDS Classtypes
32
31
1
1
1
IDS Protocols
41
13
2
2
1
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects sign-in patterns indicative of Adversary-in-the-Middle (AiTM) phishing attacks such as EvilProxy or Tycoon2FA. The rule identifies a sequence where a user fails an MFA challenge (using codes 50074 or 50140) followed by a successful authentication within a short period (1 hour) where the MFA claim appears as 'Previously satisfied' or 'already succeeded' from a different IP address or user-agent string, suggesting the session was stolen or replayed.
Detects user authentication events where the MFA redirect URL points to an unrecognized or potentially malicious domain. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, such as the TrustSink credential capture technique, where the user is diverted from the legitimate identity provider to an attacker-controlled OIDC endpoint to capture credentials or session tokens.
Detects potential Adversary-in-the-Middle (AiTM) activity by identifying a successful interactive MFA-protected sign-in followed within 15 minutes by a non-interactive (refresh token) sign-in for the same user from a different IP address, ASN, or User-Agent. This pattern is indicative of session hijacking where an attacker reuses a stolen session token.
Detects network activity associated with ngrok tunnel domains or suspicious lookalike Microsoft SSO domains (microsoft-sso.com) attempting to perform OIDC discovery, JWKS retrieval, or MFA-related EAM endpoint interactions. This behavior is indicative of adversary-in-the-middle (AiTM) attacks targeting authentication processes.
Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.
Detects successful sign-in events in Entra ID where MFA is marked as satisfied, but no interactive MFA challenge (e.g., Push, FIDO2, SMS) was recorded as completed in the authentication details. This behavior, when correlated with a new IP, device, or user-agent relative to a 30-day baseline, is highly indicative of session token replay or AitM (Adversary-in-the-Middle) attacks attempting to bypass MFA requirements.
This rule detects activities indicative of an attacker attempting to establish an adversary-in-the-middle (AiTM) position within an on-premises network. It flags potential NTLM relay attempts (via loopback or invalid workstation indicators) and unauthorized name resolution spoofing (LLMNR/NBT-NS) used to intercept and relay authentication traffic for MFA bypass or credential theft.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
This rule detects a multi-stage attack correlation where a user receives multiple inbound emails flagged for high likelihood of being LLM-generated (and containing urgency/credential-harvesting language) and subsequently performs a voice or video authentication attempt that is flagged by deepfake detection systems with a low confidence score, indicating a potential impersonation attempt.
Detects anomalous authentication behavior where the same session token or identifier is utilized by multiple distinct IP addresses or User-Agent strings within a short timeframe. This behavior is indicative of Adversary-in-the-Middle (AiTM) attacks, such as those employing Evilginx, where an attacker intercepts and replays stolen session cookies to bypass standard authentication and MFA controls.
Detects network traffic patterns associated with the ORAX/OraxRDP AiTM (Adversary-in-the-Middle) phishing toolkit. The rule monitors for specific SignalR WebSocket upgrade requests and session-related GraphQL commands (such as MirrorChallenge, Init, and Input) used to facilitate MFA relay and web session hijacking.
Detects a specific phishing pattern where a legitimate, authenticated DocuSign notification is followed by a user clicking a link within that document that redirects to known malicious infrastructure or OAuth-abuse sites (e.g., .vu domains, credential harvesting proxies). This heuristic identifies the link as being embedded in the shared document rather than the email body.
Detects network indicators and session patterns associated with the JWR Phishing Framework, specifically targeting its WebSocket-based command and control (C2) communication, client engine (main.js/ws-worker.js) retrieval, and unique session token (JWRCVV) usage.
This rule detects access to known malicious domains used in vishing-themed Adversary-in-the-Middle (AiTM) phishing campaigns. Attackers use these domains to deceive users into providing MFA credentials or session tokens, often following a voice phishing interaction where victims are directed to these sites to register or set passkeys.
Detection of network traffic patterns associated with the NovaCookies Adversary-in-the-Middle (AiTM) phishing kit. The rules monitor for DNS queries for .vu domains, HTTP requests to lookalike Microsoft 365 login pages hosted on .vu domains, POST requests containing credential data, and the receipt of specific session cookies (ESTSAUTH) indicative of successful AiTM session interception.
Detects credential-phishing attempts originating from Proton Mail addresses that result in a user clicking on a link. The rule correlates email delivery from known Proton Mail domains with subsequent URL click events to identify potential Adversary-in-the-Middle (AiTM) activity, often associated with the Star Blizzard (COLDRIVER) threat group.
Detects network activity associated with the FlowerStorm/Storm-1167 phishing campaign. The rule monitors for credential exfiltration to a specific malicious URI (e.g., /google.php) containing login parameters, as well as the delivery of spoofed Microsoft sign-in pages from the associated phishing infrastructure.
Detects instances where an administrative user performs a password or MFA method reset on a target account, followed within 24 hours by a sign-in event from that same target account flagged with a high or medium risk level. This sequence is characteristic of Adversary-in-the-Middle (AiTM) attacks, where an attacker utilizes stolen session tokens and subsequently coerces helpdesk or administrative intervention to reset MFA requirements to maintain unauthorized access.
Detects network proxy requests indicative of Adversary-in-the-Middle (AiTM) phishing kits. The rule monitors for specific URL patterns associated with malicious JavaScript delivery, administrative panels, and connections to known malicious infrastructure hosting phishing activities.
Detects network activity associated with the FlowerStorm/Storm-1167 phishing campaign. The rule monitors for credential exfiltration to a specific malicious URI (e.g., /google.php) containing login parameters, as well as the delivery of spoofed Microsoft sign-in pages from the associated phishing infrastructure.
Page 2 of 15