Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
3
Products / Services
3
MITRE Techniques
3
3
3
3
3
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
