Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
8
5
4
3
2
Contributors
20
2
1
Categories
13
11
10
9
5
Platforms
16
13
4
3
2
Products / Services
17
5
2
2
1
MITRE Techniques
12
9
9
9
8
CVEs
71
71
64
58
49
23
Detects a potential exploitation of the SearchLeak (CVE-2026-42824) vulnerability in Microsoft 365 Copilot, where raw HTML <img> tags containing Bing Search-by-Image parameters are rendered during the streaming phase before proper sanitization occurs. This could potentially allow for SSRF or information leakage through malicious image references.
Detects a potential SSRF-based exfiltration attempt by correlating DNS traffic. The rule identifies a browser session that accesses M365 Copilot (m365.cloud.microsoft) followed by a connection to Bing (bing.com), which is indicative of the exfiltration technique associated with CVE-2026-42824 involving the Bing 'searchbyimage' feature.
Detects potential data exfiltration (CVE-2026-42824) where an attacker leverages an SSRF vulnerability in Bing's search-by-image functionality to relay sensitive M365 Copilot data. The rule identifies outbound network requests to the image search endpoint containing a suspicious 'imgurl' parameter pointing to non-Microsoft infrastructure, initiated by common web browser processes.
This rule detects attempts to exploit Microsoft 365 Copilot through prompt injection, where attackers inject HTML/script elements into search queries. It specifically identifies when these queries attempt to force Copilot to interact with external URLs via Bing image search (SSRF), potentially exfiltrating sensitive data such as MFA codes, email content, or meeting details to an attacker-controlled external domain.
Detects the SearchLeak (CVE-2026-42824) delivery vector where a phishing link containing a long encoded 'q' parameter targeting Microsoft 365 Copilot Search is delivered via email to trigger prompt injection and subsequent data exfiltration of sensitive information.
Detects spearphishing attempts using SearchLeak (CVE-2026-42824) which involves delivering malicious Microsoft 365 Copilot Enterprise search URLs. These URLs utilize prompt injection via the query parameter to target high-value users, aiming to exfiltrate sensitive data such as MFA codes, email contents, or meeting details through the Copilot interface.
Detects browser-initiated DNS queries to bing.com during an active Microsoft 365 Copilot session within the same process storyline. This pattern is indicative of a potential SearchLeak HTML rendering race condition (CVE-2026-42824), where a malicious streamed <img> tag triggers an outbound request to Bing before Content Security Policy (CSP) sanitization is applied, potentially exfiltrating sensitive Copilot-retrieved mailbox data.
Detects browser processes (Chrome, Edge, Firefox, IE) being launched with a URL containing a crafted Microsoft 365 Copilot Search parameter (q=) with an unusually long command line. This pattern is indicative of potential exploitation attempts such as CVE-2026-42824 (SearchLeak), where attackers inject malicious payloads or HTML/script tags into the search query string to be processed by the browser.
Detects evidence of SearchLeak (CVE-2026-42824), a post-exploitation technique where M365 Copilot prompt injection causes a browser to perform a Bing 'searchbyimage' request. The 'imgurl' parameter points to an attacker-controlled server, with the URL path containing exfiltrated mailbox data (e.g., MFA codes, email content) encoded as underscore-delimited segments. The Bing service performs an SSRF, fetching the image from the attacker's server and thereby delivering the data while bypassing local client-side security controls like CSP.
Detects the SearchLeak (CVE-2026-42824) attack chain targeting M365 Copilot. The rule monitors for a three-stage sequence within 1 minute: (1) A user accessing a crafted Enterprise Search URL with an injected prompt in the query string; (2) Evidence of bulk data access (MailItemsAccessed or FileAccessed, 5+ events); and (3) An outbound HTTP request to a Bing image search endpoint containing exfiltrated data encoded within a long (>500 chars) 'imgurl' parameter, indicating a potential SSRF/CSP bypass exfiltration path.
Detects Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by identifying suspicious patterns in URL query parameters. The rule monitors AuditLogs for queries containing HTML tags, encoded payloads, or known malicious markers typical of prompt injection exploits against search functionalities (CVE-2026-42824).
Detects potential SearchLeak (CVE-2026-42824) prompt-to-parameter injection in Microsoft 365 Copilot Enterprise. The rule monitors for search operations containing URL-encoded characters, HTML/JS injection payloads, or anomalous long query strings that indicate a malicious attempt to influence search results or exfiltrate data.
Detects outbound proxy requests to the Bing Search-by-Image endpoint where the imgurl parameter is used to perform a server-side request forgery (SSRF). Attackers use this to bypass security controls by forcing Microsoft services to fetch an external, malicious URL containing exfiltrated data within the path, as seen in the SearchLeak (CVE-2026-42824) exploit chain.
This rule detects outbound HTTP requests to Bing's 'searchbyimage' functionality that contain an image URL pointing to a domain outside of Microsoft or Bing. This behavior is associated with a potential data exfiltration technique (referenced as CVE-2026-42824) where internal information is encoded into an image URL and passed to an external, attacker-controlled, or third-party web service via the Bing search engine to bypass traditional network egress controls.
Detects outbound requests to the Bing 'searchbyimage' endpoint where the 'imgurl' parameter points to an external (non-trusted) domain. This pattern is indicative of potential SSRF exploitation, such as the described SearchLeak (CVE-2026-42824) vulnerability chain, where an attacker uses Bing's search functionality as a proxy to reach internal or restricted infrastructure.
This rule detects exploitation attempts against Microsoft 365 Copilot (CVE-2026-42824) where attackers inject HTML or malicious prompt sequences into the 'q' query parameter. These payloads aim to perform prompt injection, SSRF via Bing, and cross-site scripting to exfiltrate sensitive data such as mailbox content and MFA tokens.
Detects potential data exfiltration from Microsoft 365 Copilot sessions where the Bing 'Search by Image' functionality is abused as an SSRF proxy. The rule identifies network requests containing external URLs within the 'imgurl' parameter, occurring shortly after Copilot activity, suggesting that internal or sensitive data (such as emails, calendar items, or MFA context) is being transmitted to an unauthorized external endpoint.
Detects the SearchLeak (CVE-2026-42824) exploit, where an attacker uses a prompt-injected M365 Copilot URL to force the assistant to search the victim's mailbox for sensitive authentication information such as MFA codes, OTPs, or security passcodes. The rule correlates an external HTTP request containing the malicious URL with a subsequent Exchange search query initiated by the Copilot service within a 2-minute window.
Detects potential exfiltration of sensitive M365 data via an SSRF vulnerability (CVE-2026-42824). The rule identifies suspicious outbound network requests to Bing's image search service where the 'imgurl' parameter contains external, non-Microsoft URLs, suggesting the service is being used as a proxy to exfiltrate data.
Detects a potential exploitation attempt of CVE-2026-42824, involving a parameter-to-prompt injection in M365 Copilot to extract sensitive data identifiers, followed by an exfiltration attempt via a Bing Search-by-Image SSRF request.
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824). Specifically looks for HTML image tags (<img src=), the variable '$TITLE', or the Bing SSRF endpoint 'bing.com/images/searchbyimage' within the URL-decoded 'q' parameter.
Page 1 of 2