Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects evidence of SearchLeak (CVE-2026-42824), a post-exploitation technique where M365 Copilot prompt injection causes a browser to perform a Bing 'searchbyimage' request. The 'imgurl' parameter points to an attacker-controlled server, with the URL path containing exfiltrated mailbox data (e.g., MFA codes, email content) encoded as underscore-delimited segments. The Bing service performs an SSRF, fetching the image from the attacker's server and thereby delivering the data while bypassing local client-side security controls like CSP.
Detects a high volume of file uploads (greater than 50) to OneDrive or SharePoint by a single user within a 5-minute window, potentially indicating bulk exfiltration of data.
Detects the SearchLeak (CVE-2026-42824) attack chain targeting M365 Copilot. The rule monitors for a three-stage sequence within 1 minute: (1) A user accessing a crafted Enterprise Search URL with an injected prompt in the query string; (2) Evidence of bulk data access (MailItemsAccessed or FileAccessed, 5+ events); and (3) An outbound HTTP request to a Bing image search endpoint containing exfiltrated data encoded within a long (>500 chars) 'imgurl' parameter, indicating a potential SSRF/CSP bypass exfiltration path.
Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.
This rule monitors authentication events across various SaaS platforms (Jira, Okta, Azure AD, Google Workspace, Auth0, OneLogin) to detect suspicious activity. It calculates a risk score based on indicators such as impossible travel, high volume of distinct source IPs or geographic locations, and anomalous user agent activity, flagging sessions that exceed a defined risk threshold.
Detects successful OAuth application consent grants or service principal role assignments involving sensitive permissions, such as read access to mail, contacts, files, or directory information. This activity is a common indicator of OAuth-based phishing or unauthorized persistent access to cloud resources.
This rule detects when a user grants an OAuth application permissions within an Azure AD or Office 365 environment, specifically monitoring for highly sensitive permissions such as 'Mail.Read', 'Files.ReadWrite', 'User.Read.All', or 'offline_access'. The rule cross-references the application ID against a known list to filter out pre-authorized applications and assigns a risk score based on the combination of granted permissions, flagging suspicious, unrecognized applications.
Detects instances where a user grants an OAuth application permissions for high-privilege scopes such as 'mail.read', 'files.readwrite', or 'offline_access'. This behavior is frequently indicative of OAuth consent phishing campaigns targeting Microsoft Entra ID environments to gain unauthorized access to user data and maintain persistence via stolen access tokens.
This rule detects anomalous high-volume file download activities from Microsoft SharePoint and OneDrive for Business, which may indicate data exfiltration. The rule aggregates download events by user and IP address over 10-minute intervals and triggers when the download count exceeds 200, excluding known service/backup accounts.
This rule monitors Microsoft Entra ID (Azure AD) sign-ins for indicators associated with the 'Payroll Pirate' campaign. It identifies non-interactive OAuth/token-based authentication requests originating from residential Internet Service Provider (ISP) ASNs using devices marked as unmanaged. It further elevates risk by detecting impossible travel (same user accessing from multiple IPs in a short window) and the use of specific browser User-Agent strings (Firefox or Axios) characteristic of the threat actor's tooling.
Detects high-volume, suspicious enumeration of HR and Payroll related information via Microsoft Graph API. The rule identifies anomalous behavior such as rapid bulk pagination, usage of suspicious user agents, and specific targeting of sensitive fields (e.g., department, job title) or keywords commonly associated with HR and financial data, likely indicating the use of a stolen OAuth token.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by identifying suspicious patterns in URL query parameters. The rule monitors AuditLogs for queries containing HTML tags, encoded payloads, or known malicious markers typical of prompt injection exploits against search functionalities (CVE-2026-42824).
Detects incoming phishing emails sent from personal Gmail accounts that attempt to impersonate law firms by using legal-themed subjects (e.g., lawsuits, subpoenas, cease and desist). The rule specifically identifies the use of URL shorteners commonly used to obfuscate credential-harvesting destinations. The detection relies on email metadata and subject line patterns to identify potential spearphishing attempts.
Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects outbound proxy traffic originating from identified AI and automation agent user-agents (e.g., ChatGPT, Perplexity, Claude, etc.) attempting to access sensitive URI paths, such as credential files, SSH keys, configuration files, or cloud-hosted secrets. This may indicate an attempt to exfiltrate sensitive data to or through AI platforms.
Detects a sequence of failed authentication attempts potentially indicative of an offline JWT secret brute-force attack (using tools like jwt_tool), followed by a successful authentication from the same source. This pattern suggests the adversary successfully recovered the secret, forged a valid token, and subsequently used it to gain unauthorized access.
Detects the addition of users to specific high-value or sensitive groups in Microsoft Entra ID (Azure AD), which could indicate potential unauthorized privilege escalation or persistence attempts by an attacker.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
Page 103 of 142