Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Identifies processes creating fake error messages with social engineering text, commonly used in ClickFix to convince users they need to “fix” something by running malicious code.
This detection identifies when Microsoft Teams applications send messages to groups / users in your organization's tenant. It utilizes the 'BotAddedToTeam' and 'AppInstalled' action types from CloudAppEvents to collect all Teams applications created in the specified timeframe and then joins on MessageEvents, matching events where SenderObjectId equals AppGuid.
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This rule detects when an application consent operation occurs in Azure Active Directory, specifically looking for broad consent types such as 'AllPrincipals' or when an administrator has granted consent. This can indicate a malicious application gaining wide permissions within the Azure AD tenant.
KQL Query
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query
KQL Query from file: Monitor Copilot Agent for SharePoint
KQL Query from file: Detecting M365 Copilot Shared Agent
KQL Query
KQL Query
KQL Query from file: Hunting malicious oauth grant by phished user
KQL Query
KQL Query from file: Overprivileged Admin-Consented OAuth Applications
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query from file: CloudApp Suspicious Copilot Agent Detection
KQL Query from file: M365 Copilot Plugins Inventory Analysis
KQL Query
KQL Query from file: OAuth app using the OD file picker permission
KQL Query from file: Detecting New Copilot Extensions
KQL Query from file: MS Teams DLP Playbook
Page 73 of 83