Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
124 detections
Filters
Last updated
All Time
Detection languages
78
17
14
6
5
Contributors
32
24
15
7
5
Categories
83
65
55
25
24
Platforms
108
30
10
3
2
Products / Services
110
35
16
14
5
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
IDS Protocols
2
This rule detects outbound automatic reply emails sent from an organization's users to external recipients. It specifically looks for emails with subjects starting with "Automatic reply:" that have been delivered and are outbound.
This rule detects suspicious inbox forwarding rules, specifically those that forward a copy of all emails to an external address. This behavior is often indicative of an attacker attempting to exfiltrate sensitive information from a compromised mailbox.
Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address
KQL Query from file: Detecting Misconfigured EXO Transport Rules
KQL Query from file: Monthly Report Entra Eligible Role Activation
'This query helps detect new Microsoft Entra ID sign in from a new location correlating with Office Activity data highlighting cases where user mails are being forwarded and shows if it is being forwarded to external domains as well.'
This query helps hunting for Inbox rule changes which forward-redirect email
This query helps hunting for email conversation take over attempts
'Identifies when multiple (more than one) users mailboxes are configured to forward to the same destination.
This could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts.'
This could be an attacker-controlled destination mailbox configured to collect mail from multiple compromised user accounts.'
Count of all Senders and where they were delivered
The following analytic identifies the creation of new email forwarding rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters like ForwardTo, ForwardAsAttachmentTo, and RedirectTo. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.
This analytic identifies the creation or modification of email inbox rules within an Office 365 environment. It specifically looks for `New-InboxRule` and `Set-InboxRule` operations in the O365 management activity logs where the rule parameters indicate actions such as mail forwarding (`ForwardTo`, `ForwardAsAttachmentTo`, `RedirectTo`), or mail manipulation like deletion (`SoftDeleteMessage`, `DeleteMessage`) or moving to specific folders (`MoveToFolder`, `CopyToFolder`). While legitimate users create inbox rules, adversaries often leverage these techniques to exfiltrate emails, maintain persistence, or hide their activities by deleting or moving security alerts.
The following analytic identifies instances where email forwarding has been enabled on mailboxes within an Office 365 environment. It detects this activity by monitoring the Set-Mailbox operation within the o365_management_activity logs, specifically looking for changes to the ForwardingAddress or ForwardingSmtpAddress parameters. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.
This analytic identifies when built-in Microsoft 365 security detections for suspicious email behaviors are triggered. These alerts often indicate that an attacker may have compromised a mailbox within the environment, leading to activities such as suspicious email sending patterns, user restrictions from sending email, suspicious email forwarding activity, or email sending limits being exceeded. Monitoring these alerts is crucial for responding to potential account compromises and malicious email activities.
This analytic identifies when a user with sufficient access to Exchange Online alters the mail flow/transport rule configuration of the organization. Transport rules are a set of rules that can be used by attackers to modify or delete emails based on specific conditions. This activity could indicate an attacker hiding or exfiltrating data by manipulating email flow.
This rule detects the creation of new mail flow rules in Office 365 that are configured to redirect or copy emails to unauthorized or external addresses. It specifically looks for the "New-TransportRule" operation in Office 365 Management Activity logs, combined with parameters such as "BlindCopyTo", "CopyTo", or "RedirectMessageTo". Such activity can indicate potential data exfiltration, unauthorized access to sensitive information, or an attacker attempting to intercept email communications, which could lead to data breaches or information leakage.
The following analytic identifies the creation of new email forwarding rules in an Office 365 environment via the UpdateInboxRules operation. It leverages Office 365 management activity events to detect rules that forward emails to external recipients by examining the OperationProperties for specific forwarding actions. This activity is significant as it may indicate unauthorized email redirection, potentially leading to data exfiltration. If confirmed malicious, attackers could intercept sensitive communications, leading to data breaches and information leakage.
This rule detects the creation or modification of email forwarding or redirection rules within Microsoft 365 audit logs. It specifically looks for operations related to 'UpdateInboxRules', 'Set-Mailbox', 'New-InboxRule', and 'Set-InboxRule' that include parameters indicative of forwarding or redirecting emails, such as 'Forward', 'Recipients', 'ForwardingSmtpAddress', 'ForwardingAddress', 'ForwardAsAttachmentTo', 'ForwardTo', 'RedirectTo', and 'RedirectToRecipients'. This activity can be a sign of an attacker attempting to exfiltrate sensitive information from a compromised mailbox or maintain persistence.
Detects when Microsoft Cloud App Security reports suspicious email forwarding rules, such as a user creating an inbox rule to forward copies of all emails to an external address. This activity can indicate an attempt to exfiltrate sensitive information.
Page 6 of 6