Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
89 detections
Filters
Last updated
All Time
Detection languages
40
38
4
2
2
Contributors
23
15
14
9
6
Categories
26
18
14
12
8
Platforms
62
26
4
4
4
Products / Services
27
16
12
8
4
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the creation or modification of inbox rules in Exchange Online that target financial-related keywords and hide/delete mail, or rules that mark all incoming mail as read and delete them, which may indicate a Business Email Compromise (BEC) attack or mailbox evasion technique.
M365 Malicious Mailbox Rule Abuse
Cortex XDR
Detects the creation or modification of Microsoft 365 Exchange inbox rules that exhibit characteristics of malicious behavior, such as using trivial or blank names, moving items to rarely-monitored folders (e.g., 'Conversation History', 'RSS Feeds'), or containing keywords related to phishing, credential harvesting, or financial fraud.
Detects high-privilege OAuth consent grants to applications shortly followed by suspicious mailbox modifications, such as creating new inbox or transport rules. This behavior is indicative of a post-compromise activity where an adversary uses an illicitly granted OAuth application to maintain persistence or exfiltrate data from an Exchange Online environment.
Detects the creation or modification of email inbox rules that perform actions such as forwarding, deleting, or moving messages combined with keywords often associated with financial fraud, business email compromise (BEC), or credential harvesting. Adversaries often use these rules to hide communications, redirect financial emails, or automate data exfiltration.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects modifications to the Outlook Security registry key, specifically setting the 'Level' value to '1'. This configuration (often associated with 'OutlookSecurityMode' or related programmatic access policies) can be used by adversaries to bypass security prompts when accessing the Outlook Object Model, allowing malicious scripts or applications to interact with Outlook to send emails, harvest contacts, or access attachments without user intervention.
Detects modifications to the Outlook Security registry key, specifically setting the 'Level' value to '1'. This configuration (often associated with 'OutlookSecurityMode' or related programmatic access policies) can be used by adversaries to bypass security prompts when accessing the Outlook Object Model, allowing malicious scripts or applications to interact with Outlook to send emails, harvest contacts, or access attachments without user intervention.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
Detects installation of malicious Office add-ins for persistent macro execution
Detects the creation or modification of inbox rules that automatically mark emails as read and move them to a folder. This behavior is commonly used by adversaries to hide phishing replies or other malicious email activity from the victim's primary inbox.
Detects malicious files written to Office XLSTART or Word STARTUP folders
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Detects malicious files written to Office XLSTART or Word STARTUP folders
This rule detects the delivery of potentially malicious Microsoft Office startup files (Excel, Word, PowerPoint macro-enabled or binary files) via HTTP. It specifically looks for files with extensions like .xlsb, .xlsm, .docm, .pptm, or .dotm in the HTTP URI and checks for the presence of "vbaProject" content within the file data, indicating the presence of VBA macros which are often used in malicious documents.
Detects creation of malicious inbox rules via Exchange Web Services for persistence
This rule detects when an Office Add-in is loaded from a remote URL, specifically targeting graph.microsoft.com. It looks for HTTP POST requests where the host is 'graph.microsoft.com' and the URI contains 'addIns'. This activity could indicate an attempt to establish persistence or execute malicious code via Office Add-ins.
Detects download of macro-enabled Office templates for persistent macro execution
Page 1 of 5