Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects OAuth consent grants or permission additions in Microsoft Entra ID (Azure AD) audit logs that occur in conjunction with device login flow artifacts. This pattern is indicative of 'ConsentFix' or device code phishing attacks, where users are manipulated into authorizing malicious applications, potentially bypassing MFA requirements by using the device code flow.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.
Detects malicious Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by monitoring search query parameters for indicators of natural-language command injection or HTML-based payload injection (e.g., img tags, source manipulation, or data extraction commands).
This rule detects potential unauthorized access and environment variable disclosure attempts against the Flowise API, specifically targeting the MCP (Model Context Protocol) endpoints. It monitors for path traversal-like patterns using case variants (e.g., /api/v1/env), unauthorized access to configuration endpoints, and the exposure of sensitive data like API keys, database URLs, and passwords in API responses or request headers.
This rule detects potential session token theft or replay attacks by identifying non-interactive sign-in events that occur from a different IP or geographic location than the user's most recent successful MFA-authenticated interactive session. It flags cases where a non-interactive token is used within a short timeframe (1 hour) of an interactive session from a different location, which may indicate the exfiltration and subsequent use of session cookies or OAuth tokens.
Detects Microsoft 365 sign-in patterns indicative of an adversary bypassing Conditional Access device compliance requirements using an edge appliance proxy. The rule identifies successful authentication sessions from non-compliant or unmanaged devices that satisfy Conditional Access, often involving impossible travel or multiple source IPs, suggesting the use of an intermediary infrastructure to masquerade as a trusted location.
Detects potentially malicious or anomalous queries within Microsoft 365 Copilot interactions. The rule monitors for patterns indicating attempts at data exfiltration (e.g., HTML/image embedding, image search parameters), unauthorized information extraction (e.g., email or title extraction), or targeting of sensitive authentication-related information (e.g., OTP or MFA codes).
Detects instances where a user account modifies sensitive payroll or banking information (e.g., direct deposit details) shortly after performing a sign-in from an unmanaged device or suspicious context. This behavior is indicative of an Adversary-in-the-Middle (AiTM) token replay attack targeting HR SaaS applications like Workday to perform financial fraud.
Detects sign-in events using the device code authentication flow (OAuth 2.0 device authorization grant) where the originating IP address is external to the organization's private network. This flow is often abused by attackers to bypass traditional MFA or interact with headless environments via common HTTP client libraries like Python requests, Go-http, or Axios.
Detects successful OAuth device code authentication flows targeted at sensitive Microsoft cloud resources (Exchange Online, SharePoint, Teams, Graph) originating from unmanaged or non-compliant devices. This pattern is often indicative of consent phishing or device code phishing attacks where an adversary obtains a device token to gain long-term unauthorized access to user data.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects a suspicious spike in Microsoft Teams external meeting or chat invitations directed at a single user within a 30-minute window. This behavior is consistent with UNC6692 tactics, where attackers impersonate internal IT helpdesk staff via Teams to perform vishing and social engineering attacks.
Detects spearphishing attempts using SearchLeak (CVE-2026-42824) which involves delivering malicious Microsoft 365 Copilot Enterprise search URLs. These URLs utilize prompt injection via the query parameter to target high-value users, aiming to exfiltrate sensitive data such as MFA codes, email contents, or meeting details through the Copilot interface.
Detects anomalous account enumeration attempts by monitoring Azure AD Sign-in logs for a high volume of '50034' error codes (invalid username) originating from a single IP address within a short time window. This behavior is often indicative of an adversary attempting to identify valid user accounts within the environment.
Detects HTTP requests to Gitea instances containing the X-WEBAUTH-USER header, which facilitates user impersonation when Gitea is misconfigured with 'REVERSE_PROXY_TRUSTED_PROXIES = *' in a Docker environment. This vulnerability (CVE-2026-20896) allows an unauthenticated attacker to impersonate any user, including administrators.
Detects Microsoft Graph API requests that perform bulk enumeration of email messages across multiple folders. The rule specifically identifies API queries that request sender (From) and recipient (To, CC, BCC) fields, a behavior consistent with mailbox address harvesting or reconnaissance by an Address Extractor module.
This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.
This rule detects a potential MFA fatigue attack by identifying users who experienced a high volume of denied MFA requests (5 or more) followed by at least one successful authentication within a 15-minute window across Okta and Azure Active Directory platforms.
This rule detects successful authentication attempts directed at network devices from sources not explicitly marked as authorized management systems. It identifies users or systems that are not recognized service accounts authenticating against network infrastructure and flags activity that involves multiple unique destination targets as high risk.
Detects browser-initiated DNS queries to bing.com during an active Microsoft 365 Copilot session within the same process storyline. This pattern is indicative of a potential SearchLeak HTML rendering race condition (CVE-2026-42824), where a malicious streamed <img> tag triggers an outbound request to Bing before Content Security Policy (CSP) sanitization is applied, potentially exfiltrating sensitive Copilot-retrieved mailbox data.
Page 102 of 142