Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
Detects inbound emails that spoof ServiceNow branding or impersonate high-level organizational roles (e.g., CEO, VP, President) in the display name while using common reply/forward subject headers. The rule specifically flags these if the sender domain does not originate from a legitimate service-now.com domain and contains PDF or HTML attachments, which are common vectors for credential harvesting or malware delivery.
Detects inbound emails that spoof ServiceNow branding or impersonate high-level organizational roles (e.g., CEO, VP, President) in the display name while using common reply/forward subject headers. The rule specifically flags these if the sender domain does not originate from a legitimate service-now.com domain and contains PDF or HTML attachments, which are common vectors for credential harvesting or malware delivery.
Detects activity from Anthropic network range across multiple event types
This rule monitors various logs (email, entra, device, graph, cloud) for IP addresses (source or remote) that match a specific CIDR range (160.79.104.0/21). This is typically used to identify traffic originating from or communicating with infrastructure identified as malicious or suspicious by threat intelligence.
This rule monitors incoming emails by cross-referencing sender addresses against a hardcoded list of known malicious or suspicious email accounts. It associates these emails with any potential attachments to provide context for further investigation.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
This rule detects potential phishing activity by correlating email delivery events and URL click events against a set of known malicious domains and suspicious URL paths. It identifies when a user receives an email containing a suspicious link or interacts with such a link, providing visibility into potential credential harvesting or malware delivery attempts.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
This rule monitors email traffic for communication involving identified malicious domains and sender addresses. It cross-references sender information in the EmailEvents log with a predefined set of suspicious domains and email addresses, highlighting potential phishing or malicious outreach attempts.
This rule identifies potential phishing emails that impersonate OneDrive sharing notifications. It correlates email messages containing keywords typically associated with document sharing (e.g., 'OneDrive', 'shared', 'file') with subsequent user URL clicks. Crucially, the rule filters for clicks to domains that are not explicitly related to legitimate OneDrive, SharePoint, or 1drv.ms hosting, indicating a potential attempt to lure users to a malicious third-party site under the guise of file sharing.
This rule detects potential phishing activity by correlating email delivery events and URL click events against a set of known malicious domains and suspicious URL paths. It identifies when a user receives an email containing a suspicious link or interacts with such a link, providing visibility into potential credential harvesting or malware delivery attempts.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
Detects incoming emails from specific suspicious domains that pass authentication checks (SPF, DKIM, DMARC) but contain subject lines commonly associated with phishing campaigns, such as invoices, payment requests, or urgent notifications. The rule includes associated URL and attachment information for further analysis.
Detects inbound emails masquerading as reputable advisory firms (PwC or KPMG) using lookalike sender domains, combined with wire-transfer fraud phrases in the subject line. Correlates with identity logon telemetry for the same fraudulent WhatsApp Business phone number, enabling detection across both email and authentication channels. Note: message body content is not available in the EmailEvents schema, so fraud-phrase matching is subject-only.
Page 16 of 40