Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
27
13
7
4
3
Contributors
24
12
6
5
2
Categories
19
14
10
9
7
Platforms
26
12
7
7
7
Products / Services
10,680
9,761
6,694
4,418
3,744
MITRE Techniques
21
17
17
13
11
CVEs
1
1
1
IDS Classtypes
2
1
IDS Protocols
3
This rule detects scenarios where an existing SSO or Identity Provider (IdP) session is reused from a device context that differs from the one that originally performed MFA. It identifies this by joining authentication events by SessionId, specifically looking for instances where MFA occurred in one event and a subsequent non-MFA event for the same session has a different User-Agent, DeviceId, JA3 hash, or Operating System build, indicating potential session token theft or reuse.
Detects a suspected Multi-Factor Authentication (MFA) fatigue attack, characterized by a user denying three or more consecutive MFA authentication requests in a short period (10 minutes) followed by a successful authentication approval. This behavior often indicates an adversary bombarding a user with push notifications to eventually solicit an accidental or coerced approval.
Detects anomalous authentication behavior where a single session identifier is used to access three or more distinct SaaS applications within a one-hour window. This behavior often indicates the unauthorized use of a stolen session cookie or OAuth token (Pass-the-Cookie) across multiple SSO-integrated platforms.
This rule detects scenarios where an existing SSO or Identity Provider (IdP) session is reused from a device context that differs from the one that originally performed MFA. It identifies this by joining authentication events by SessionId, specifically looking for instances where MFA occurred in one event and a subsequent non-MFA event for the same session has a different User-Agent, DeviceId, JA3 hash, or Operating System build, indicating potential session token theft or reuse.
Detects user authentication events where the MFA redirect URL points to an unrecognized or potentially malicious domain. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, such as the TrustSink credential capture technique, where the user is diverted from the legitimate identity provider to an attacker-controlled OIDC endpoint to capture credentials or session tokens.
Detects anomalous authentication behavior where a single session identifier is used to access three or more distinct SaaS applications within a one-hour window. This behavior often indicates the unauthorized use of a stolen session cookie or OAuth token (Pass-the-Cookie) across multiple SSO-integrated platforms.
Detects a single user identity authenticating into three or more distinct SaaS applications within a 10-minute window. This behavior is consistent with the replay of a stolen session cookie (Pass-the-Cookie) or the abuse of an active authenticated session to move laterally across a federated SaaS estate.
Detects SAML token authentication events where the token-signing certificate does not match the established federation baseline (indicating potential token forging or unauthorized IdP activity) or where critical conditional access claims (MFA and device compliance) are missing from the SAML assertion.
Detects a suspected Multi-Factor Authentication (MFA) fatigue attack, characterized by a user denying three or more consecutive MFA authentication requests in a short period (10 minutes) followed by a successful authentication approval. This behavior often indicates an adversary bombarding a user with push notifications to eventually solicit an accidental or coerced approval.
Detects user authentication events that exhibit patterns consistent with Adversary-in-the-Middle (AiTM) phishing campaigns, specifically those leveraging passkey or SSO-themed lures and device-code authentication flows.
This rule monitors authentication events across various SaaS platforms (Jira, Okta, Azure AD, Google Workspace, Auth0, OneLogin) to detect suspicious activity. It calculates a risk score based on indicators such as impossible travel, high volume of distinct source IPs or geographic locations, and anomalous user agent activity, flagging sessions that exceed a defined risk threshold.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
This rule identifies potential session hijacking or session replay attacks by detecting successful logins from the same user account using the same User-Agent string but originating from different source IP addresses within a one-hour window. This behavior is indicative of an attacker replaying stolen session cookies, effectively bypassing Multi-Factor Authentication (MFA) requirements associated with initial authentication.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects forged Golden SAML tokens used for identity federation bypass
This rule detects a high volume of HTTP requests to Salesforce API endpoints associated with bulk data queries. Specifically, it looks for 20 or more requests within a 60-second window from a single source IP to 'salesforce.com' with URI paths containing both '/services/data/' and '/query/'. This pattern suggests a potential bulk download of customer records or other data via the Salesforce API.
Detects forged Golden SAML tokens used for identity federation bypass
Page 1 of 3