Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
Detects activity from Anthropic network range across multiple event types
This rule detects potentially malicious or automated data access patterns within Microsoft 365 or similar cloud environments. It identifies user accounts or applications that exhibit a high volume of file/email access operations across a diverse set of paths, which is often indicative of automated data exfiltration, scraping, or suspicious collection by a compromised identity.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects high-frequency requests to Microsoft Graph API endpoints related to messages, mailFolders, or attachments, indicative of an adversary performing mailbox reconnaissance or data collection via cloud APIs.
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects a high volume of subscription or account confirmation emails directed at a single recipient within a one-hour window. This behavior, often referred to as 'email bombing,' can be used to disrupt user productivity, overwhelm inbox capacity, or serve as a distraction technique to hide other malicious activities, such as spearphishing or account takeover notifications.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects incoming emails that impersonate DocuSign notifications, specifically looking for typical phishing lures involving 'Remittance Advice' and a call-to-action to 'Tap here to view document'. This rule identifies emails using common social engineering tactics to harvest credentials or distribute malware via fake document links.
This rule identifies potential phishing emails that impersonate OneDrive sharing notifications. It correlates email messages containing keywords typically associated with document sharing (e.g., 'OneDrive', 'shared', 'file') with subsequent user URL clicks. Crucially, the rule filters for clicks to domains that are not explicitly related to legitimate OneDrive, SharePoint, or 1drv.ms hosting, indicating a potential attempt to lure users to a malicious third-party site under the guise of file sharing.
Detects a sequence of events starting with a device code OAuth sign-in, followed within two hours by the creation or modification of inbox rules and high-frequency enumeration of email items (contacts, folders, messages, threads, people) via Microsoft Graph API. This behavior is indicative of post-compromise activity where an adversary uses OAuth device code grants to maintain access and subsequently automates inbox analysis or data harvesting.
This rule monitors for email events where the email is flagged for suspicious properties (SPF/DKIM/DMARC failure, threat categorization) and includes potentially malicious attachments or URLs. It then correlates these suspicious emails with subsequent process execution events on the recipient's endpoint within a 30-minute window, identifying a potential successful execution of a phishing payload.
Detects the RejectDirectSend bypass (null SMTP envelope sender + internal-domain spoof). Tightened to require Microsoft's composite auth verdict OR all of SPF/DKIM/DMARC failing (vs. any one), excludes known-approved Direct Send relay IPs, and excludes likely-legitimate bulk/newsletter traffic via BulkComplaintLevel.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects SCL-9 (high-confidence phishing/spam) messages that still reach an inbox, indicating an allow-list or transport-rule override, and enriches with any recent tenant mail-flow admin changes. Rewritten: removed a no-op self-join on EmailEvents and a broken exact-match join against CloudAppEvents' raw audit blob (was comparing a sender address against a whole JSON record and would never match); now excludes messages later auto-remediated (e.g. ZAP-quarantined) via the native LatestDeliveryLocation field, and correlates admin rule/allow-list changes via substring match over a cross join.
Detects a sequence of events starting with a device code OAuth sign-in, followed within two hours by the creation or modification of inbox rules and high-frequency enumeration of email items (contacts, folders, messages, threads, people) via Microsoft Graph API. This behavior is indicative of post-compromise activity where an adversary uses OAuth device code grants to maintain access and subsequently automates inbox analysis or data harvesting.
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
Detects successful post-delivery email remediation actions (such as ZAP, manual deletion, or moving to junk) performed on emails associated with the Operation DoppelBrand campaign, identified by specific sender domains (service-nowinc.com, domainlify.net) or suspicious invoice-fraud subject lines.
Detects successful post-delivery email remediation actions (such as ZAP, manual deletion, or moving to junk) performed on emails associated with the Operation DoppelBrand campaign, identified by specific sender domains (service-nowinc.com, domainlify.net) or suspicious invoice-fraud subject lines.
Page 15 of 40