Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
254 detections
Filters
Last updated
All Time
Detection languages
167
41
16
14
10
Contributors
61
60
42
18
13
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
133
108
85
38
34
Products / Services
112
83
65
30
30
MITRE Techniques
75
74
36
36
35
CVEs
7
6
6
6
6
Detects potential lateral movement by users who have recently been flagged for credential theft or infostealer activity. The rule correlates initial security alerts with subsequent Windows logon events (RDP, network/WinRM) or SMB share access, identifying users connecting to multiple distinct destinations within a 48-hour window.
Detects a suspicious sequence of events where a user exhibits signs of account compromise—either through impossible travel patterns or the use of OAuth tokens on a new device—followed within one hour by the modification of mailbox settings, such as creating new inbox rules or modifying mailbox permissions, which is a common indicator of persistence and email exfiltration.
Detects potential password spraying activity targeting Azure AD accounts. The rule identifies a pattern where a single source IP address attempts to authenticate against a high volume of distinct accounts within a one-hour window, while keeping the number of failed attempts per individual account low to evade traditional brute force thresholds.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects successful authentication events for accounts that have been dormant for at least 90 days, correlated with suspicious activity markers such as recent failed sign-in attempts, access from an unfamiliar geographic location or ASN, or a complete absence of historical sign-in activity.
Detects MFA-fatigue style attacks (push-bombing) against Microsoft 365 accounts. The rule identifies a pattern where a user experiences a high frequency of MFA challenges or denials (at least 5 within a 10-minute window) immediately followed by a successful sign-in from a previously unseen IP and device, excluding phishing-resistant authentication methods and break-glass accounts.
Detects potential AI model backdoor trigger attempts by identifying inference requests from a single caller that result in high-confidence, rare-label predictions across multiple distinct input artifacts. This pattern is indicative of an adversary probing or activating a poisoned model by injecting specific triggers designed to force anomalous outputs.
This rule detects a multi-stage attack correlation where a user receives multiple inbound emails flagged for high likelihood of being LLM-generated (and containing urgency/credential-harvesting language) and subsequently performs a voice or video authentication attempt that is flagged by deepfake detection systems with a low confidence score, indicating a potential impersonation attempt.
Detects potential training data poisoning attempts by monitoring anomalies in ingestion volume, shifts in label distribution, and high-volume submissions from feedback channels. This rule uses statistical analysis to identify spikes in data input or abnormal distributions that deviate from established historical baselines.
Detects instances where a user grants high-privilege permissions (Mail.Read, Files.ReadWrite.All, offline_access) to an OAuth application within 24 hours of a risky sign-in event. This pattern is commonly observed in AiTM (Adversary-in-the-Middle) or consent-phishing attacks designed to establish persistent access to cloud resources.
Detects sign-in activity using the OAuth 2.0 device code flow, followed by subsequent authentication attempts from the same account originating from anomalous, previously unseen geographic locations or using unfamiliar applications. This pattern is indicative of a device code phishing attack where an adversary lures a user into authorizing a malicious device or application and subsequently hijacks the resulting session to access resources from a different location.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.
Detects anomalous sign-in patterns indicative of real-time MFA relay attacks, where a user principal authenticates successfully from multiple distinct IP addresses and geographical locations within a short time window (15 minutes), suggesting the active interception of credentials and MFA challenges by a Phishing-as-a-Service platform.
Detects anomalous sign-in patterns indicative of real-time MFA relay attacks, where a user principal authenticates successfully from multiple distinct IP addresses and geographical locations within a short time window (15 minutes), suggesting the active interception of credentials and MFA challenges by a Phishing-as-a-Service platform.
Detects anomalous sign-in patterns indicative of real-time MFA relay attacks, where a user principal authenticates successfully from multiple distinct IP addresses and geographical locations within a short time window (15 minutes), suggesting the active interception of credentials and MFA challenges by a Phishing-as-a-Service platform.
Detects successful authentication events for accounts that have been dormant for at least 90 days, correlated with suspicious activity markers such as recent failed sign-in attempts, access from an unfamiliar geographic location or ASN, or a complete absence of historical sign-in activity.
Detects successful authentication events for accounts that have been dormant for at least 90 days, correlated with suspicious activity markers such as recent failed sign-in attempts, access from an unfamiliar geographic location or ASN, or a complete absence of historical sign-in activity.
This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.
Detects sign-in activity using the OAuth 2.0 device code flow, followed by subsequent authentication attempts from the same account originating from anomalous, previously unseen geographic locations or using unfamiliar applications. This pattern is indicative of a device code phishing attack where an adversary lures a user into authorizing a malicious device or application and subsequently hijacks the resulting session to access resources from a different location.
Page 4 of 13