Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
149 detections
Filters
Last updated
All Time
Detection languages
84
20
13
12
8
Contributors
59
14
12
11
10
Categories
75
61
47
34
23
Platforms
125
55
31
15
6
Products / Services
124
27
24
11
8
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects a suspicious sequence of events where a user exhibits signs of account compromise—either through impossible travel patterns or the use of OAuth tokens on a new device—followed within one hour by the modification of mailbox settings, such as creating new inbox rules or modifying mailbox permissions, which is a common indicator of persistence and email exfiltration.
Detects high-privilege OAuth consent grants to applications shortly followed by suspicious mailbox modifications, such as creating new inbox or transport rules. This behavior is indicative of a post-compromise activity where an adversary uses an illicitly granted OAuth application to maintain persistence or exfiltrate data from an Exchange Online environment.
Detects specific, targeted search operations within M365 environments for keywords related to payroll, HR, and banking information. This behavior is indicative of post-compromise reconnaissance activity, often following AiTM (Adversary-in-the-Middle) session hijacking where an attacker attempts to locate financial documents and payroll correspondence.
Detects M365 administrative actions related to mailbox forwarding rules or OAuth application consent that occur in the absence of a Multi-Factor Authentication (MFA) claim, particularly when preceded by non-interactive session events (LogonType 0) using REST client protocols. This pattern is indicative of potential session hijacking or token replay attacks, where an adversary leverages a compromised session to establish persistence or gain ongoing access to the environment without re-authenticating.
Detects potential persistence establishment in M365 environments following anomalous or risky sign-in events. This pattern is characteristic of Adversary-in-the-Middle (AiTM) attacks where a session cookie is stolen, followed by immediate adversary actions to secure long-term access, such as MFA method registration, OAuth app consent, or mailbox rule configuration.
Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects a high volume of 'MailItemsAccessed' operations within a short 15-minute window performed by a specific application ID. This behavior is often indicative of automated, bulk exfiltration of emails from a Microsoft 365 environment, potentially by a compromised application or an attacker using a malicious OAuth application.
Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.
Detects high-volume, diverse administrative and discovery activities in cloud environments, including SharePoint site enumeration, Azure AD user/identity discovery, and suspicious access to mail items via specific client applications, potentially indicating post-compromise reconnaissance or data harvesting.
Detects anomalous access to email items in Microsoft 365 Exchange environments by monitoring the 'MailItemsAccessed' operation. The rule flags specific, non-standard pairings of 'ClientAppId' and 'APIId' associated with malicious activity, indicating potential unauthorized data collection or exfiltration by attackers bypassing standard Outlook client behavior.
Detects suspicious O365 'MailItemsAccessed' activity using a specific OAuth application (AppId c999ed3e-27ae-4cb3-b3a2-46b056af63d3) and ClientId (5d661950-3475-41cd-a2c3-d671a3162bc1) with an 'Bind' operation type. This pattern is often associated with unauthorized email access across multiple tenant accounts. The rule triggers when at least 5 events are detected across 2 or more distinct tenant accounts within a 1-minute window, using a specific Firefox user agent.
Detects anomalous 'Bind' operations in Microsoft 365 Exchange Online audit logs where the user-agent string includes 'Firefox/131.0' and 'Client=REST' while using specific Microsoft Outlook ClientAppId and APIId parameters. This pattern has been observed in automated, cross-tenant mailbox exfiltration campaigns targeting sensitive payroll and financial documentation.
This rule detects unauthorized mailbox access by identifying specific ClientAppId and API ID pairs known to be associated with an Office 365 email exfiltration toolkit. This activity is indicative of an attacker attempting to programmatically access or exfiltrate sensitive email data from the organization's environment.
This rule detects potentially unauthorized access or downloading of files from SharePoint and OneDrive, as well as specific MailItemsAccessed events associated with known exfiltration toolkit patterns within Microsoft 365. It flags individual events matching these criteria as a baseline for identifying suspicious data access behaviors.
Detects anomalous, high-volume access to email items by specific applications known to be associated with suspicious activity or unusual access patterns within the Exchange environment, potentially indicating email harvesting or data exfiltration.
Detects the creation of email mailbox or transport rules that perform actions like hiding, deleting, marking as read, forwarding, or redirecting emails with finance or payment-related keywords. This behavior is indicative of a Business Email Compromise (BEC) post-exploitation workflow where adversaries attempt to conceal malicious activity or divert financial communications.
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks by identifying an initial legitimate sign-in followed by a second sign-in from a different IP address within a short timeframe (indicative of session token replay), immediately succeeded by high-risk post-compromise actions such as OAuth application consent or the creation of malicious mailbox rules.
Detects anomalous, high-volume email access patterns (more than 200 mail items accessed per hour) by specific Client or Azure AD App IDs, which may indicate automated data collection or exfiltration by an adversary using compromised or unauthorized applications.
Detects anomalous, high-volume email access patterns (more than 200 mail items accessed per hour) by specific Client or Azure AD App IDs, which may indicate automated data collection or exfiltration by an adversary using compromised or unauthorized applications.
Detects high-frequency, automated polling of Microsoft 365 mailbox data via the Microsoft Graph API, characteristic of malicious inbox scanning tools (e.g., Box Monitor). The rule correlates these persistent access patterns with subsequent searches for high-value financial keywords, identifying potential Business Email Compromise (BEC) reconnaissance.
Page 2 of 8