Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
Detects suspicious O365 'MailItemsAccessed' activity using a specific OAuth application (AppId c999ed3e-27ae-4cb3-b3a2-46b056af63d3) and ClientId (5d661950-3475-41cd-a2c3-d671a3162bc1) with an 'Bind' operation type. This pattern is often associated with unauthorized email access across multiple tenant accounts. The rule triggers when at least 5 events are detected across 2 or more distinct tenant accounts within a 1-minute window, using a specific Firefox user agent.
Detects the creation or modification of O365 inbox rules designed to move incoming emails to the 'Deleted Items' folder, delete messages, or mark them as read. This behavior is a common indicator of an adversary attempting to hide phishing lures, security alerts, or C2 communications within a compromised mailbox.
This rule detects high-confidence phishing emails that were delivered to either the Inbox or Junk folder. It explicitly filters out messages that have been explicitly allowed by organization-level policies, user-level actions, or specific safe-sender bypass mechanisms, ensuring the alert focuses on malicious emails that bypassed standard security filters without an authorized exception.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
This rule detects potentially unauthorized access or downloading of files from SharePoint and OneDrive, as well as specific MailItemsAccessed events associated with known exfiltration toolkit patterns within Microsoft 365. It flags individual events matching these criteria as a baseline for identifying suspicious data access behaviors.
Detects anomalous, high-volume access to email items by specific applications known to be associated with suspicious activity or unusual access patterns within the Exchange environment, potentially indicating email harvesting or data exfiltration.
This rule detects when a user grants OAuth application permissions for high-risk scopes (e.g., Mail, Files) to an application that was registered within the last 7 days. It correlates this event with subsequent suspicious actions performed by the same user, specifically mailbox rule modifications or file download activity, which are common indicators of post-compromise activity following OAuth consent phishing.
This rule detects mass phishing campaigns by identifying HTML/HTM email attachments that contain embedded URLs. It monitors for a pattern where the same sender distributes these attachments to multiple recipients, a common behavior for HTML smuggling delivery vectors where malicious payloads are constructed client-side to bypass static email gateway inspection.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
Detects the creation or modification of email inbox rules that perform suspicious actions such as deleting, moving to folders, or forwarding emails, specifically when those rules target keywords associated with sensitive financial or business communications like invoices, payments, or wire transfers. This behavior is indicative of an attacker attempting to hide evidence of a compromise or intercept sensitive business communications.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
Detects incoming emails processed by Rspamd that exhibit suspicious authentication header signatures. The rule identifies emails lacking DKIM, ARC, or user agent information while simultaneously showing a zero receive count, potentially indicating spoofed, unauthenticated, or malformed phishing attempts.
This rule detects inbound phishing emails that leverage urgent security themes (e.g., passkey, SSO, or MFA updates) to lure users into clicking links. It correlates these emails with subsequent URL clicks and suspicious sign-in activity, such as MFA failures, which are indicative of an attempt to compromise credentials or bypass MFA.
Detects emails from specific suspicious domains or senders masquerading as executive roles (CEO, CFO) that contain attachments with 'invoice' in the filename and subject lines indicative of urgent financial transactions (e.g., payment, wire transfer). This pattern is commonly associated with Business Email Compromise (BEC) and malicious document delivery.
Detects incoming emails from specific suspicious domains that pass authentication checks (SPF, DKIM, DMARC) but contain subject lines commonly associated with phishing campaigns, such as invoices, payment requests, or urgent notifications. The rule includes associated URL and attachment information for further analysis.
Page 10 of 40