Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule identifies potential prompt injection attempts against Microsoft Copilot and Azure OpenAI services by monitoring CloudAppEvents for specific adversarial markers, encoded instruction blocks, or hidden text patterns. It flags recurring attempts from a single user as suspicious probing activity.
Detects credential-phishing attempts originating from Proton Mail addresses that result in a user clicking on a link. The rule correlates email delivery from known Proton Mail domains with subsequent URL click events to identify potential Adversary-in-the-Middle (AiTM) activity, often associated with the Star Blizzard (COLDRIVER) threat group.
Detects a multi-stage phishing pattern attributed to Star Blizzard (also known as Callisto Group or COLDRIVER). The attack involves an initial email containing no attachments to establish trust or initiate a thread, followed by a subsequent reply-thread email containing both an archive file (ZIP/RAR) and an image file. This technique is designed to bypass email security scanners by hiding the archive password within the image attachment or obscuring the malicious payload context.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule monitors inbound emails for sender domains or embedded URLs that contain strings related to popular AI service brands (e.g., ChatGPT, Gemini, Claude). It flags these occurrences when the domain does not match the official, legitimate domains for those services, indicating potential phishing or brand impersonation attempts.
Detects instances where a user account consents to an OAuth application requesting high-privilege or sensitive scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This behavior is a common indicator of consent phishing attacks, where adversaries trick users into granting persistent access to their cloud resources via malicious OAuth applications.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects account modification activity (e.g., password resets or MFA registration changes) followed within 24 hours by a sign-in event for the same user account that is flagged as risky or exhibits anomalous device/location characteristics, indicative of social engineering campaigns like Scattered Spider.
This rule detects incoming phishing emails that use specific financial or payment-related lures (e.g., 'eft wire transfer', 'invoice receipt') in the subject line or body to entice users into clicking a link that points directly to an executable file, often disguised as a document.
Detects a suspicious sequence where a user completes a device-code authentication flow followed shortly by consenting to high-risk OAuth permissions. This pattern is characteristic of consent phishing and device-code phishing attacks, where an attacker leverages these methods to gain persistent access to a user's cloud resources via malicious application tokens.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects the creation of a new Entra ID application followed closely by high-privilege permission grants or consent. This is a common technique used by attackers to establish persistent access to cloud resources, such as mailboxes or sensitive data, via OAuth application backdoors.
Detects the granting of elevated mailbox permissions (FullAccess, SendAs, SendOnBehalf, or broad folder access) by an OAuth application or service principal. This behavior is indicative of a compromise where an actor uses an App-only context to establish persistence and stage internal spearphishing, bypassing standard administrative monitoring controls.
Detects unauthorized changes to the token-signing certificate for federated domains in Microsoft Entra ID (formerly Azure AD). This behavior is often associated with the Golden SAML attack technique, where an adversary modifies federation settings to forge authentication tokens. The rule filters for events occurring outside of standard business hours and alerts when the modification is not performed by known automation service accounts.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Detects the creation or modification of Granular Delegated Administrative Privileges (GDAP) relationships, or the assignment of highly privileged (Tier 0) roles, when performed by an application identified as a partner provider or via delegated administration. This rule monitors for potential abuse of trusted partner relationships to escalate privileges or establish persistence within a tenant.
Detects instances where an administrative user grants 'AllPrincipals' OAuth consent to a multi-tenant application that is unverified or lacks a trusted publisher. This behavior is indicative of an attacker tricking a global admin into granting broad permissions (e.g., Mail.Read, Files.ReadWrite.All) to a malicious application, bypassing per-user consent restrictions.
Detects the addition of suspicious, attacker-controlled URLs (such as webhook.site, ngrok.io, or pipedream.net) as valid redirect URIs in an OAuth application's configuration. This technique can be used by an adversary to intercept OAuth authorization codes or tokens by luring users through a malicious authorization link, enabling persistent unauthorized access without further consent.
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
Page 10 of 179