Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
18
6
5
4
2
Contributors
8
5
5
5
4
Categories
11
7
7
7
6
Platforms
22
12
4
1
Products / Services
12
6
5
3
3
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories.
It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*".
This activity is significant as it may indicate data exfiltration or unauthorized access to email data.
If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network.
It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*".
This activity is significant as it may indicate data exfiltration or unauthorized access to email data.
If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network.
Detects DNS resolution attempts for graph.microsoft.com by processes other than standard web browsers or mail clients. This activity is indicative of scripted tools or malicious software attempting to enumerate or access Microsoft 365 mailbox content via the Graph API, bypassing normal user interaction.
Detects file access events targeting the Mozilla Thunderbird profile directory on Windows systems, which may indicate unauthorized collection or theft of local email data, archives, and account configuration files.
Detects a non-browser mailbox collection or archive utility connecting directly to an IP address while RemoteUrl is empty. This behavior is suspicious as legitimate email clients typically use hostnames. The rule filters out common browsers and svchost.exe and looks for keywords in the command line indicative of mailbox or archive activity (e.g., .pst, .ost, Aspose.Email, mailbox, archive). This suggests an attempt to exfiltrate or collect email data, potentially bypassing DNS resolution for C2 or evasion.
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
Detects creation of inbox rules to hide attacker communications from victim
Detects bulk email collection via IMAP protocol for mass email harvesting
This rule detects when an Outlook OST (Offline Storage Table) file is accessed over SMB (Server Message Block) protocol. The detection is triggered by the presence of the string ".ost" (case-insensitive) in the network traffic on port 445 (SMB). This activity could indicate an attempt to collect local email data.
This rule detects when a file with the ".pst" extension (Outlook Personal Storage Table file) is copied locally via the Server Message Block (SMB) protocol. This could indicate data exfiltration or unauthorized access to sensitive email archives.
Detects unexpected access to PhoneExperiences-*.db files which may contain synchronized SMS and OTP messages. This behavior is associated with the CloudZ RAT and Pheno plugin bypassing SMS-based MFA.
Detects creation of named pipes with UIA_PIPE_ prefix, which are used by Microsoft's UI Automation framework.
This activity may indicate malicious use of UI Automation for credential theft or unauthorized UI interaction.
Coyote malware has been observed using UI Automation to extract credentials from banking applications.
This activity may indicate malicious use of UI Automation for credential theft or unauthorized UI interaction.
Coyote malware has been observed using UI Automation to extract credentials from banking applications.
Detects potential email harvesting using PowerShell cmdlets with export parameters, stealth flags, and uncommon parent processes.
KQL Query from file: Threat hunting voice phishing for Teams
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: MDO Email Threat Classification By ISP
KQL Query from file: MDO Email Threat Classification By Country
Page 1 of 2