Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
17
5
4
2
1
Contributors
9
5
3
3
1
Categories
16
16
5
2
2
Platforms
24
17
2
2
2
Products / Services
25
2
2
2
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
Detects Microsoft Teams chat creation events originating from an external sender whose user ID or display name impersonates IT support (e.g., IT Support, Help Desk, Service Desk), often used in social engineering or phishing attempts.
Detects one subject line delivered to an unusually wide internal recipient set. This
is the shape of internal phishing from a compromised mailbox, which is far more
effective than external phishing because it arrives from a trusted colleague and
passes authentication checks.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE' and action='EMAIL_DELIVERED'
| duration 1h
| groupby subject, sender
| select subject, sender, distinct_count(recipient)
| having distinct_count_col1 > 25
is the shape of internal phishing from a compromised mailbox, which is far more
effective than external phishing because it arrives from a trusted colleague and
passes authentication checks.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE' and action='EMAIL_DELIVERED'
| duration 1h
| groupby subject, sender
| select subject, sender, distinct_count(recipient)
| having distinct_count_col1 > 25
Detects scenarios where an account experiences mail bombing activity followed closely by a suspicious Microsoft Teams chat initiation by an external user within a 2-hour window, potentially indicating a multi-stage social engineering or extortion campaign.
This rule detects potentially malicious messages within Microsoft Teams that use common social engineering keywords related to security configuration changes (e.g., passkey, MFA, SSO). The detection specifically filters for users who have successfully logged in within the last 30 days to identify potential compromised accounts acting as internal senders.
Detects Microsoft Teams communication (calls, chats, messages) originating from a different tenant where the sender's display name is identified as IT Support, Help Desk, or similar. This behavior is indicative of external actors attempting to impersonate internal IT staff to facilitate social engineering or credential harvesting.
Detects potential lateral phishing attempts within Microsoft Teams by identifying a single user account sending messages containing common credential-harvesting lures (e.g., 'passkey', 'SSO', 'MFA', 'security update') to multiple internal recipients in a short timeframe.
Detects internal phishing messages sent via Microsoft Teams that contain common credential-harvesting lures (e.g., passkey, MFA, SSO updates) where the sender account has also exhibited indicators of compromise within the preceding 24 hours, such as risky sign-ins or impossible travel.
Detects Microsoft Teams messages containing urgent language and themes related to passkey or SSO updates, which are indicative of a phishing attempt aimed at harvesting credentials or performing account takeover.
Detects potential social engineering attacks in Microsoft Teams where an internal user sends multiple messages containing terms related to MFA, SSO, or passkey updates, potentially attempting to harvest credentials from other users.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects Microsoft Teams messages containing keywords related to authentication updates, passkey enrollment, or SSO changes combined with urgent language or calls to action (e.g., clicking links). The rule attempts to identify potential credential harvesting or account takeover attempts within the chat platform.
Detects anomalous activity by newly added guest users in Microsoft Teams, specifically identifying when a guest user account is added and subsequently performs multiple file-related operations (upload, download, access) or message-sending activities within a short timeframe. This behavior can be indicative of external threat actors or compromised guest accounts exfiltrating or accessing sensitive information within a Teams workspace.
Detects messages sent, chats created, or members added within Microsoft Teams that involve external participants and contain embedded HTTP or HTTPS links. This behavior is indicative of potential external spearphishing or malicious link distribution through collaborative chat platforms.
Detects instances where Microsoft Teams logs report a message containing a 'Malicious url'. This suggests a potential phishing attempt via Teams, where a user is being sent a link classified as malicious by security systems.
Detects malicious Android applications that leverage Accessibility Services for automated interaction. Specifically, the rule monitors for the installation of an app, followed by the immediate enabling of Accessibility Services and subsequent synthetic tap events on the screen within a narrow timeframe. This pattern is characteristic of malware attempting to automatically grant itself sensitive permissions or bypass user consent dialogs, such as the behavior observed in the BTMOB RAT.
Detects a suspicious spike in Microsoft Teams external meeting or chat invitations directed at a single user within a 30-minute window. This behavior is consistent with UNC6692 tactics, where attackers impersonate internal IT helpdesk staff via Teams to perform vishing and social engineering attacks.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects a suspicious spike in Microsoft Teams external meeting or chat invitations directed at a single user within a 30-minute window. This behavior is consistent with UNC6692 tactics, where attackers impersonate internal IT helpdesk staff via Teams to perform vishing and social engineering attacks.
Detects a suspicious spike in Microsoft Teams external meeting or chat invitations directed at a single user within a 30-minute window. This behavior is consistent with UNC6692 tactics, where attackers impersonate internal IT helpdesk staff via Teams to perform vishing and social engineering attacks.
Page 1 of 2