Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
5
1
Contributors
2
1
1
1
1
Categories
4
3
2
1
1
Platforms
4
2
Products / Services
4
4
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects the creation or modification of Exchange Online inbox rules, transport rules, or mailbox settings where the rule name consists exclusively of special characters. This pattern can be indicative of malicious activity, such as an attacker attempting to hide a forwarding rule or other automated action by using an obscure name.
Detects the creation or modification of Exchange inbox rules that move messages to potentially risky folders (e.g., Deleted Items, Junk Email, RSS Feeds, Archive, Clutter) or are configured to delete messages. This behavior can be indicative of an attacker attempting to hide malicious emails, exfiltrate data, or disrupt email flow.
This rule detects the use of the hacktool Ruler by Sensepost, specifically looking for 'RULER' in the Workstation or WorkstationName fields of Windows Security Event IDs 4776 (Credential Validation) and 4624/4625 (Logon/Logoff). Ruler is a tool designed to abuse Microsoft Exchange services.
KQL Query from file: Detecting Misconfigured EXO Transport Rules
This query helps hunting for Inbox rule changes which forward-redirect email
Get stats on ASR audit events - count events and machines per rule.