Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
Detects incoming emails that impersonate DocuSign notifications, specifically looking for typical phishing lures involving 'Remittance Advice' and a call-to-action to 'Tap here to view document'. This rule identifies emails using common social engineering tactics to harvest credentials or distribute malware via fake document links.
Detects high-volume internal email campaigns that exhibit characteristics of phishing, specifically utilizing sender display name impersonation of executive or IT support roles, urgent subject lines, and URLs identified as malicious by threat intelligence. The rule tracks common attributes like SPF/DKIM/DMARC failures and rapid delivery to multiple recipients.
Detects incoming emails from an external domain where the email subject contains the recipient's normalized local name. This is a common pattern for targeted phishing or 'CEO fraud' style attacks where the subject is crafted to mimic personalized or internal communications.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects inbound emails where the sender domain mimics finance-themed brands (using a regex-based pattern) and includes URLs redirecting through the ActiveCampaign platform tracking domains (activehosted.com or acemlnd.com). This rule identifies potential phishing campaigns attempting to use legitimate email marketing infrastructure to bypass reputation-based filters.
Detects the creation or modification of inbox rules in Office 365 that involve automatic email forwarding, redirection, or deletion. Such rules are commonly created by adversaries to exfiltrate email data or maintain persistent access to a compromised mailbox.
This rule monitors for incoming emails containing suspicious attachments (such as .htm, .xhtml, .svg, or QR codes) associated with common business-related subject lines or file names (e.g., 'contract', 'agreement', 'edocs'). It specifically identifies emails originating from 'amazonses.com' that do not match expected trusted domains like DocuSign or Workday, indicating a potential credential harvesting or phishing attempt.
Inbound email campaigns containing links to external personal SharePoint sites (*-my.sharepoint.com) sent to multiple recipients.
Provides a consolidated view of email metadata, delivery outcomes, attachments, embedded URLs, sender infrastructure, and security verdicts for inbound and outbound email investigations.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
Detects inbound emails containing password-protected archives (rar, zip, 7z) from either common freemail providers or domains matching known social engineering themes (e.g., webinar, interview, research). The rule specifically flags emails where the subject or body includes password hints (e.g., 'pwd', 'extract', 'unzip') indicating an attempt to deliver malicious payloads while evading email gateway inspection.
Aggregates identity, endpoint, cloud application, and messaging telemetry to build a consolidated profile of the devices, clients, applications, and user agents associated with a specific user account.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
This rule detects potential spearphishing attempts by identifying emails with ZIP attachments that contain filenames or subjects masquerading as specific organizations or job opportunities (e.g., 'Lockheed Martin', 'Enveil'). It triggers on incoming emails containing suspicious job-lure keywords in the subject line or file attachments, which are often used to deliver initial access payloads.
Identifies inbound email campaigns that deliver URLs to large numbers of recipients and groups activity by parent domain.
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
Detects anomalous mailbox access via the MailItemsAccessed operation, specifically identifying the unique ClientAppId and API pairing associated with the Storm-2755 (Payroll Pirates) adversary campaign. This activity indicates unauthorized access to email content, typically targeting high-value personnel such as payroll, finance, and HR staff through Adversary-in-the-Middle (AiTM) techniques.
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
Detects inbound email messages authenticated with an amazonses.com DKIM signature that originate from a specific Amazon SES Tokyo-region relay IP address. This may indicate an adversary is leveraging a compromised or unauthorized transactional email account (e.g., SES or third-party platforms like Resend) to send emails on behalf of a victim domain.
This rule detects potentially malicious mailbox search and item access activity in Microsoft 365. It monitors for users who trigger both 'Search' and 'MailItemsAccessed' actions within a one-hour window. The detection logic flags behavior that includes a high volume of mail access (more than 10 events) or access originating from multiple distinct IP addresses, which are common indicators of automated collection or credential compromise.
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
Detects anomalous mailbox activity in Microsoft 365 where a user account performs both search operations and mail item access, particularly when the activity originates from multiple IP addresses or exceeds a threshold of mail items accessed within a one-hour window. This behavior often indicates potential mailbox compromise or unauthorized data collection.
Detects a password reset followed by the deletion of two or more verified security-notification emails (matched to actual notification sender domains) within 24 hours, prioritizing permanent deletions as higher-confidence evidence-destruction behavior.
Detects the creation of a new inbox rule that performs email manipulation actions (forward, redirect, delete, move, or stop processing) shortly after a user account has logged in with a high or medium risk score, or an unusual result type. This pattern is commonly indicative of account compromise where an attacker establishes persistence or data exfiltration via mailbox rules.
Page 22 of 40