Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects anomalous non-interactive OAuth token requests against Microsoft Graph that claim multi-factor authentication (MFA) satisfaction from unmanaged devices. This behavior is indicative of Adversary-in-the-Middle (AiTM) token replay attacks, where captured session tokens are reused by an attacker to bypass authentication controls, consistent with tactics used by threat actors like Storm-2755 (Payroll Pirate).
This rule detects attempts to exploit Microsoft 365 Copilot through prompt injection, where attackers inject HTML/script elements into search queries. It specifically identifies when these queries attempt to force Copilot to interact with external URLs via Bing image search (SSRF), potentially exfiltrating sensitive data such as MFA codes, email content, or meeting details to an attacker-controlled external domain.
Detects OAuth consent grants or permission additions in Microsoft Entra ID (Azure AD) audit logs that occur in conjunction with device login flow artifacts. This pattern is indicative of 'ConsentFix' or device code phishing attacks, where users are manipulated into authorizing malicious applications, potentially bypassing MFA requirements by using the device code flow.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
This rule detects potential brute force attacks against Microsoft Exchange Outlook Web App (OWA) by monitoring for a high volume of 401 Unauthorized status codes from non-internal IP addresses. It also correlates these authentication events with subsequent post-authentication actions, specifically identifying mailbox logins followed by mailbox searching or export requests, which may indicate account compromise and unauthorized data collection or exfiltration.
Detects malicious Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by monitoring search query parameters for indicators of natural-language command injection or HTML-based payload injection (e.g., img tags, source manipulation, or data extraction commands).
Detects incoming emails where a single URL contains indicators of two or more distinct security vendor rewriting services. This technique is used by adversaries to create multi-layered redirect chains to bypass automated scanners and deliver malicious content, as seen in Tycoon2FA and Sneaky2FA campaigns.
Detects potentially malicious or anomalous queries within Microsoft 365 Copilot interactions. The rule monitors for patterns indicating attempts at data exfiltration (e.g., HTML/image embedding, image search parameters), unauthorized information extraction (e.g., email or title extraction), or targeting of sensitive authentication-related information (e.g., OTP or MFA codes).
Detects instances where a user account modifies sensitive payroll or banking information (e.g., direct deposit details) shortly after performing a sign-in from an unmanaged device or suspicious context. This behavior is indicative of an Adversary-in-the-Middle (AiTM) token replay attack targeting HR SaaS applications like Workday to perform financial fraud.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
Detects OAuth application consent grants or modifications where the application is granted sensitive permissions including Mail.Read, Directory.Read.All, or User.Read.All. These permissions can be abused by attackers to exfiltrate email data or map the organization's directory.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
This rule detects a multi-stage phishing campaign involving Gmail-hosted emails containing 'short.gy' URLs. It monitors for three distinct signals: (1) Outbound network connections to 'chongdaotang.net', (2) User clicks on 'short.gy' links arriving from Gmail addresses, and (3) Inbound or BCC-delivered emails from Gmail senders containing 'short.gy' links. This combination is highly indicative of a phishing operation attempting to redirect users to a malicious infrastructure.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
Detects a suspicious spike in Microsoft Teams external meeting or chat invitations directed at a single user within a 30-minute window. This behavior is consistent with UNC6692 tactics, where attackers impersonate internal IT helpdesk staff via Teams to perform vishing and social engineering attacks.
Detects the SearchLeak (CVE-2026-42824) delivery vector where a phishing link containing a long encoded 'q' parameter targeting Microsoft 365 Copilot Search is delivered via email to trigger prompt injection and subsequent data exfiltration of sensitive information.
Detects spearphishing attempts using SearchLeak (CVE-2026-42824) which involves delivering malicious Microsoft 365 Copilot Enterprise search URLs. These URLs utilize prompt injection via the query parameter to target high-value users, aiming to exfiltrate sensitive data such as MFA codes, email contents, or meeting details through the Copilot interface.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Page 101 of 179