Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
18
5
4
2
1
Contributors
9
5
3
3
1
Categories
17
16
5
2
2
Platforms
25
18
2
2
2
Products / Services
26
2
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects a suspicious spike in Microsoft Teams external meeting or chat invitations directed at a single user within a 30-minute window. This behavior is consistent with UNC6692 tactics, where attackers impersonate internal IT helpdesk staff via Teams to perform vishing and social engineering attacks.
This rule detects internal SMTP traffic that contains both 'Content-Type: application/' and 'filename=' in the email body. This combination is often indicative of an attachment being sent, and in the context of 'Lateral Phishing' (T1534), it suggests an attempt to send malicious attachments internally. The rule is set to trigger an alert if 5 such events occur from the same source IP within 300 seconds, indicating a potential automated or high-volume internal phishing attempt.
This rule detects chat or call activity by external users in Microsoft Teams whose source tenant is not present in a pre-defined whitelist. This could indicate unauthorized external communication or potential data exfiltration attempts.
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query from file: Critical Vulnerability in Elastic Kibana
This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query looks for Teams messages from an external user with a suspicious display name.
In this query, we are looking for emails containing malware attachment sent by an internal sender
Page 2 of 2