Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
2
2
Contributors
3
2
1
1
1
Categories
7
5
2
1
1
Platforms
6
2
1
Products / Services
6
2
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
2
IDS Protocols
2
Detects anomalous activity where a single user or service principal downloads more than 5 Microsoft Teams meeting recordings within a 1-hour window. This behavior potentially indicates an insider threat or compromised account performing bulk harvesting of sensitive meeting content.
Detects anomalous activity where a single user or service principal downloads more than 5 Microsoft Teams meeting recordings within a 1-hour window. This behavior potentially indicates an insider threat or compromised account performing bulk harvesting of sensitive meeting content.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window from a single identity and IP address. This behavior can indicate data exfiltration or reconnaissance by an adversary.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window. This behavior can indicate data exfiltration or collection by an adversary.
Detects anomalous activity where a single user or service principal downloads more than 5 Microsoft Teams meeting recordings within a 1-hour window. This behavior potentially indicates an insider threat or compromised account performing bulk harvesting of sensitive meeting content.
This rule detects when a user downloads a large amount of Slack message history via the Slack API. It specifically looks for HTTP requests to 'slack.com' with the URI '/conversations.history' and triggers an alert if 20 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate sensitive communication data.
This rule detects bulk harvesting of Microsoft Teams messages via the Graph API. It triggers when a client makes 20 or more HTTP requests within 60 seconds to graph.microsoft.com with URIs containing both '/teams/' and '/messages'. This behavior could indicate an attempt to exfiltrate a large volume of communication data from Microsoft Teams.
KQL Query
