Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.
Detects a significant surge of bulk or spam mail quarantine events for a single mailbox within a 15-minute window. This behavior often indicates a mail-bombing attack intended to overwhelm the user or as a distraction technique (smokescreen) to hide concurrent malicious activities such as exfiltration, lateral movement, or ransomware staging in the M365 tenant.
Detects high-volume internal email campaigns that exhibit characteristics of phishing, specifically utilizing sender display name impersonation of executive or IT support roles, urgent subject lines, and URLs identified as malicious by threat intelligence. The rule tracks common attributes like SPF/DKIM/DMARC failures and rapid delivery to multiple recipients.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects incoming or outgoing emails with subject lines containing keywords associated with extortion, data leaks, or data breaches, specifically when accompanied by email attachments.
Detects the creation of an inbox rule in Microsoft 365 that includes common financial terms ('invoice', 'payment', 'wire', 'transfer') and utilizes email forwarding ('ForwardTo' or 'RedirectTo'). This pattern is highly indicative of Business Email Compromise (BEC) attempts, where an attacker intercepts financial correspondence.
Detects the creation of an inbox rule in Microsoft 365 occurring shortly after a user's mailbox items were accessed. This pattern is often indicative of account compromise where an adversary accesses a mailbox to identify sensitive information and subsequently creates inbox rules (e.g., to redirect or delete emails) to maintain persistence or conceal their activity.
Detects network activity and email headers associated with the DoppelBrand campaign. The rule monitors DNS queries for specific IOC domains (service-nowinc.com, domainlify.net) and inspects SMTP traffic for malicious MAIL FROM addresses and Reply-To headers targeting these domains.
Detects network activity and email headers associated with the DoppelBrand campaign. The rule monitors DNS queries for specific IOC domains (service-nowinc.com, domainlify.net) and inspects SMTP traffic for malicious MAIL FROM addresses and Reply-To headers targeting these domains.
Detects inbound emails that spoof ServiceNow branding or impersonate high-level organizational roles (e.g., CEO, VP, President) in the display name while using common reply/forward subject headers. The rule specifically flags these if the sender domain does not originate from a legitimate service-now.com domain and contains PDF or HTML attachments, which are common vectors for credential harvesting or malware delivery.
Detects inbound emails from external domains containing keywords related to financial transactions or urgency in the subject line (specifically matching forwarded or reply formats) accompanied by PDF or HTML attachments. This heuristic approach attempts to identify potential business email compromise (BEC) or phishing lures mimicking invoices or approval requests in environments where raw email body content is unavailable.
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects inbound emails that use a combination of finance-related keyword patterns in the domain and ActiveCampaign-specific relay infrastructure naming conventions. This technique is often used in phishing campaigns to bypass filters by leveraging trusted third-party email service provider infrastructure.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Page 17 of 40