Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects potential Adversary-in-the-Middle (AiTM) activity by identifying a successful interactive MFA-protected sign-in followed within 15 minutes by a non-interactive (refresh token) sign-in for the same user from a different IP address, ASN, or User-Agent. This pattern is indicative of session hijacking where an attacker reuses a stolen session token.
Detects a sequence of events where a user with a high-risk or compromised sign-in status registers a new device in Entra ID shortly after the event, followed by subsequent sign-ins from that device that bypass multi-factor authentication (MFA) via Conditional Access policies.
Detects MFA relay phishing kits (such as Bluekit) where the MFA challenge is satisfied by an attacker-controlled proxy rather than the legitimate user device. The rule identifies sign-in attempts where the primary authentication request originates from one network location, while the MFA completion step originates from a different network location, and the MFA claim indicates it was satisfied via a proxied token.
Detects the registration or modification of multi-factor authentication (MFA) security information in Entra ID or Okta that occurs within 15 minutes of a sign-in event flagged as risky. This behavioral pattern is a common indicator of persistence being established by an attacker after performing an adversary-in-the-middle (AiTM) attack, where they leverage a stolen session to register their own MFA factors to maintain long-term access.
This rule detects the unauthorized download of complete ML model checkpoint or weight files from a model registry or object storage. It monitors for common model file extensions in download events that are not associated with a legitimate deployment justification or a pre-approved change management window, helping to identify potential intellectual property theft or model exfiltration attempts.
Detects high-privilege user accounts (e.g., executives, administrators) undergoing a credential or MFA reset, followed by an atypical sign-in event within a two-hour window. This pattern is indicative of potential account takeover or identity-compromise scenarios, often associated with help-desk vishing attacks where an attacker induces a user or administrator to reset credentials or MFA methods.
Detects a two-stage activity: first, the potential unauthorized reading or access of LLM provider API keys from files, environment variables, or command-line arguments; and second, the subsequent use of those same credentials to authenticate to LLM provider APIs (OpenAI, Anthropic, Azure, Bedrock) from a different, unrecognized source IP address, indicating potential credential theft and session hijacking.
Detects Azure AD / Entra ID sign-in events that utilize the OAuth 2.0 device code authentication flow. This protocol, designed for input-constrained devices, is frequently exploited by adversary-in-the-middle phishing kits (e.g., EvilTokens) to trick users into authorizing a malicious session, effectively bypassing traditional MFA by obtaining an active session token.
Detects instances where a user authenticates via the OAuth 2.0 device code flow followed shortly by a new device registration. The rule flags registrations where the device name shape is uncommon compared to historical data or where there is a mismatch between the IP address used for the authentication and the registration, indicating potential device code phishing or account takeover.
Detects anomalous sign-in patterns indicative of real-time MFA relay attacks, where a user principal authenticates successfully from multiple distinct IP addresses and geographical locations within a short time window (15 minutes), suggesting the active interception of credentials and MFA challenges by a Phishing-as-a-Service platform.
Detects high-volume, rapid enumeration of core Microsoft Graph directory endpoints (users, groups, applications, and servicePrincipals) by a single identity or session. This behavior is indicative of reconnaissance tools such as AADInternals, ROADtools, or TokenTactic being used to map out a cloud environment's directory structure.
Detects the addition or modification of federated identity credentials within Microsoft Entra ID (Azure AD). Adversaries may add these credentials to service principals or applications to achieve persistent access and potentially bypass traditional password-based authentication mechanisms.
Joins password reset events to subsequent legacy-protocol (IMAP/POP/SMTP/ActiveSync) or non-interactive sign-ins for the same user, catching attackers who pivot to less-monitored protocols immediately after a vished self-service reset.
Detects tenant-level enablement of Microsoft Teams external/federated access or addition of an unfamiliar external domain shortly before a spike in inbound Teams calls to helpdesk/IT-support-tagged users — models CrowdStrike's 2026 Financial Services Threat Landscape Report on 'Mutant Spider,' the most active threat to financial services, whose primary technique is voice phishing over Microsoft Teams impersonating internal IT.
This rule detects scenarios where a user account modifies Conditional Access (CA) policies (specifically targeting user or group inclusion/exclusion settings) within one hour of that same user account modifying authentication method policies. This pattern is potentially indicative of an adversary weakening security controls by adjusting authentication requirements and subsequently tampering with CA policies to maintain persistence or bypass MFA.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
Single-source Sigma proxy for the authentication-persistence stage of the multi-stage device-code-phishing-to-Graph-collection chain (see the companion KQL correlation rule "Passkey Persistence: Device-Code Phishing to MFA Takeover and Graph Collection" for the full, threshold-gated, cross-table detection). Sigma has no join, temporal-windowing, or aggregation support, so this rule fires on the authentication-persistence event alone and does NOT enforce the device-code sign-in precursor or the subsequent Graph-activity burst - both required by the full correlation. Scoped to the two highest-signal operations only (new security-info registration, and any admin-initiated registration on another user's account) to cut noise from routine self-service profile edits.
Single-source Sigma proxy for the authentication-persistence stage of the multi-stage device-code-phishing-to-Graph-collection chain (see the companion KQL correlation rule "Passkey Persistence: Device-Code Phishing to MFA Takeover and Graph Collection" for the full, threshold-gated, cross-table detection). Sigma has no join, temporal-windowing, or aggregation support, so this rule fires on the authentication-persistence event alone and does NOT enforce the device-code sign-in precursor or the subsequent Graph-activity burst - both required by the full correlation. Scoped to the two highest-signal operations only (new security-info registration, and any admin-initiated registration on another user's account) to cut noise from routine self-service profile edits.
Detects the multi-stage Microsoft cloud identity compromise chain reported by Microsoft Security Research (September 2026): a victim completes a successful Entra ID device-code sign-in (often induced by passkey-themed device-code phishing), the same identity's authentication/security info is registered or changed (MFA/passkey persistence) within 60 minutes (deduplicated to the earliest such event per sign-in), followed within 120 minutes by a burst of at least 25 successful, delegated-context Microsoft Graph API calls (Scopes claim populated, i.e. user-delegated permissions rather than pure application/client-credential access) spanning at least 3 distinct resource paths, exhibiting reconnaissance (>=5 requests against /users, /groups, /directoryRoles, /roleManagement, /applications, /servicePrincipals, /organization) and/or collection (>=10 requests against /messages, /mailFolders, /attachments, /drive, /drives, /sites, /lists, /search) patterns. Restricting to delegated (Scopes-bearing) Graph calls and requiring resource-path breadth removes the two largest false-positive sources: service-principal/application-only automation jobs (Roles-only tokens) and single-endpoint polling tools. Pure behavioral correlation across SigninLogs, AuditLogs, and MicrosoftGraphActivityLogs - no static IOCs. Flags whether Graph activity originated from an IP different from the original device-code sign-in IP as a strong pivot/session-reuse indicator.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
Detects a single identity listing access keys for a high volume (20+) of Azure Storage Accounts within a 15-minute window. This behavior is indicative of credential harvesting, reconnaissance, or automated exfiltration attempts targeting storage resources.
Page 23 of 184