Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects when a user grants an OAuth application permissions within an Azure AD or Office 365 environment, specifically monitoring for highly sensitive permissions such as 'Mail.Read', 'Files.ReadWrite', 'User.Read.All', or 'offline_access'. The rule cross-references the application ID against a known list to filter out pre-authorized applications and assigns a risk score based on the combination of granted permissions, flagging suspicious, unrecognized applications.
Detects instances where a user grants an OAuth application permissions for high-privilege scopes such as 'mail.read', 'files.readwrite', or 'offline_access'. This behavior is frequently indicative of OAuth consent phishing campaigns targeting Microsoft Entra ID environments to gain unauthorized access to user data and maintain persistence via stolen access tokens.
Detects the creation or modification of Exchange inbox rules that configure automatic forwarding or redirection of email to external domains. Attackers often use this technique to exfiltrate email data, maintain persistence, or monitor communications.
This rule detects anomalous high-volume file download activities from Microsoft SharePoint and OneDrive for Business, which may indicate data exfiltration. The rule aggregates download events by user and IP address over 10-minute intervals and triggers when the download count exceeds 200, excluding known service/backup accounts.
Detects automated enumeration patterns via the Microsoft Graph API, specifically targeting bulk directory pulls (requests with $top=999) and keyword-based searches for sensitive organizational data (payroll, HR, finance). This rule aggregates activity by user session to identify suspicious volumes and diversity of requests.
This rule monitors Microsoft Entra ID (Azure AD) sign-ins for indicators associated with the 'Payroll Pirate' campaign. It identifies non-interactive OAuth/token-based authentication requests originating from residential Internet Service Provider (ISP) ASNs using devices marked as unmanaged. It further elevates risk by detecting impossible travel (same user accessing from multiple IPs in a short window) and the use of specific browser User-Agent strings (Firefox or Axios) characteristic of the threat actor's tooling.
Detects the use of PowerShell to perform automated reconnaissance against Microsoft Graph API endpoints, specifically targeting HR, payroll, and personal user data. This activity is associated with post-compromise behaviors seen in campaigns like Payroll Pirate, where attackers utilize compromised credentials to harvest sensitive organizational information.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
Detects high-volume, suspicious enumeration of HR and Payroll related information via Microsoft Graph API. The rule identifies anomalous behavior such as rapid bulk pagination, usage of suspicious user agents, and specific targeting of sensitive fields (e.g., department, job title) or keywords commonly associated with HR and financial data, likely indicating the use of a stolen OAuth token.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects phishing emails containing specific Latin placeholder text artifacts, commonly generated by the Faker library, which are often indicative of unconfigured or template-based phishing kits embedded within email bodies or attachments.
Detects Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by identifying suspicious patterns in URL query parameters. The rule monitors AuditLogs for queries containing HTML tags, encoded payloads, or known malicious markers typical of prompt injection exploits against search functionalities (CVE-2026-42824).
This rule detects potential bulk phishing email campaigns by identifying a high volume of emails originating from external senders (not @company.com) with suspicious subject lines containing keywords like 'action required', 'verify account', or 'confirm identity'. The rule triggers if at least 50 such emails are sent to 20 or more unique recipients within a one-hour window.
Detects network requests to Microsoft Graph API that appear to be modifying authentication methods, specifically targeting phone-based multi-factor authentication settings. This may indicate an adversary attempting to register their own MFA device to a compromised account to maintain persistence or bypass MFA.
This rule detects successful additions or updates to service principal credentials or application certificates/secrets within Azure AD. This activity can indicate persistence establishment by an attacker who has compromised an account with sufficient permissions to manipulate application identities.
Detects the addition of users to specific high-value or sensitive groups in Microsoft Entra ID (Azure AD), which could indicate potential unauthorized privilege escalation or persistence attempts by an attacker.
Detects the creation or modification of inbox rules in Office 365/Exchange that configure email forwarding or redirection to external domains. Attackers often use these rules to exfiltrate email data or maintain persistence within an environment by redirecting communications to attacker-controlled accounts.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
Page 103 of 179