Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mailbox read/write permissions, followed immediately by the creation of an inbox rule (forwarding, moving, or deleting) targeting messages containing keywords like 'invoice', 'wire', or 'payment'.
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mailbox read/write permissions, followed immediately by the creation of an inbox rule (forwarding, moving, or deleting) targeting messages containing keywords like 'invoice', 'wire', or 'payment'.
Detects the creation or modification of Microsoft 365/Exchange inbox rules that suggest malicious staging or exfiltration activities. This includes rules configured for external email auto-forwarding, automatic deletion of messages, or movement of emails into hidden/system folders (e.g., RSS Subscriptions, Archive) which may be filtered based on sensitive keywords related to financial or credential theft (e.g., invoice, wire, payment).
Detects mailbox permission changes (FullAccess, SendAs) or abnormally high volume of mailbox item access events occurring shortly after a risky, non-interactive, or unusual location sign-in. This pattern indicates a potential follow-on activity from a successful session hijacking or token theft attack.
Detects mailbox permission changes (FullAccess, SendAs) or abnormally high volume of mailbox item access events occurring shortly after a risky, non-interactive, or unusual location sign-in. This pattern indicates a potential follow-on activity from a successful session hijacking or token theft attack.
Detects the creation or modification of Exchange mailbox or transport rules that exhibit suspicious characteristics, such as external forwarding, movement to hidden or system folders, automatic deletion/marking as read, or rules containing keywords related to financial fraud. The rule specifically monitors for activities occurring via non-standard or automated clients to increase detection fidelity.
Detects the creation or modification of Exchange mailbox or transport rules that exhibit suspicious characteristics, such as external forwarding, movement to hidden or system folders, automatic deletion/marking as read, or rules containing keywords related to financial fraud. The rule specifically monitors for activities occurring via non-standard or automated clients to increase detection fidelity.
Detects the creation or modification of Exchange inbox rules that involve suspicious actions, such as forwarding or redirecting emails to external domains, deleting messages, or marking messages as read. These actions are common indicators of persistent access or data exfiltration attempts following a mailbox compromise.
Detects high-volume mailbox item access (MailItemsAccessed) within 15-minute intervals, correlated with risky Entra ID sign-in events within a 60-minute window. This behavior is indicative of automated mail reconnaissance or data exfiltration following potential cloud account compromise.
Detects the creation or modification of inbox rules in Office 365 that exhibit suspicious characteristics, such as external forwarding, automatic deletion/moving of sensitive emails (e.g., security alerts, junk), or rules containing keywords related to fraud. The rule optionally correlates this activity with recent anomalous sign-in attempts by the same user to identify potential account compromise.
Detects inbound emails containing malicious QR codes (quishing) or HTML smuggling payloads designed to facilitate credential harvesting (AiTM). The rule identifies suspicious attachments, HTML-based obfuscation (e.g., atob, Blob) in email bodies, and QR-code-themed image attachments, filtering out internal communications.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
This rule detects a multi-stage Business Email Compromise (BEC) attack involving executive impersonation via look-alike domains, followed by the creation of suspicious inbox rules (forwarding/deletion) by the victim, and concurrent external communication (Teams/Zoom meeting invites) from a newly created account. It correlates these activities to identify sophisticated payment fraud campaigns.
This rule detects a multi-stage Business Email Compromise (BEC) attack involving executive impersonation via look-alike domains, followed by the creation of suspicious inbox rules (forwarding/deletion) by the victim, and concurrent external communication (Teams/Zoom meeting invites) from a newly created account. It correlates these activities to identify sophisticated payment fraud campaigns.
Detects high-privilege OAuth consent grants to applications shortly followed by suspicious mailbox modifications, such as creating new inbox or transport rules. This behavior is indicative of a post-compromise activity where an adversary uses an illicitly granted OAuth application to maintain persistence or exfiltrate data from an Exchange Online environment.
Detects phishing emails that utilize document-themed subjects (e.g., invoices, shared documents) containing Windows Internet Shortcut (.url) attachments that redirect users to Cloudflare Workers-based 'docviewer' pages, often linked in conjunction with suspicious SharePoint file shares.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
This rule monitors email traffic to detect scenarios where a single recipient is receiving a large volume of emails (at least 30 messages) from a high number of unique senders (at least 15) within a one-hour window. This behavior is indicative of a potential bulk spam or phishing campaign targeting a specific mailbox, which may be attempting to overwhelm the recipient or bypass traditional filters through volume.
Page 6 of 40