Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,865
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects Entra ID guest (B2B) users performing a sign-in from a previously unseen IP address or country (observed over the last 30 days), followed within a 4-hour window by sensitive file operations in SharePoint, OneDrive, or Teams (e.g., file downloads, exports, or sensitivity label changes). This pattern is indicative of potential account takeover or unauthorized access to sensitive corporate data.
Detects the creation or modification of Named Locations within Conditional Access policies that include IP ranges. This behavior could indicate an attacker whitelisting their own IP addresses to maintain persistence or bypass Conditional Access security controls. The rule correlates changes with administrative context, such as non-standard business hours, weekends, or modifications by unexpected accounts.
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
This rule detects potentially unauthorized or suspicious Google Forms collaboration invitations delivered via email. It filters for emails that pass full sender authentication (SPF, DKIM, and DMARC) and originate from Google infrastructure, while containing a specific Google Forms editor invite URL pattern. The rule excludes internal organizational communications from the Google domain and identifies specific return-path domains commonly associated with automated Google Forms sharing notifications to highlight external or unexpected collaboration requests.
Detects high-velocity queries to Graph API regarding transitiveRoleAssignments, a Tycoon 2FA post-compromise activity. This activity is indicative of reconnaissance for role assignments within Microsoft Graph, potentially by an adversary like Volt Typhoon (Tycoon 2FA).
Detects incoming emails originating from Google infrastructure (Gmail or Google Forms) where the sender's display name closely matches the recipient's local username part. This heuristic is commonly used to identify targeted spearphishing campaigns where attackers impersonate internal users or trusted entities via abuse of legitimate Google services.
This rule detects potentially malicious email messages masquerading as Google Forms collaboration invitations. It identifies emails originating from Google-related domains that contain URLs for Google Forms with invite parameters. The detection logic filters for messages passing SPF, DKIM, and DMARC authentication checks to highlight legitimate-looking emails that may be part of a social engineering campaign, and flags instances where the sender's display name matches the recipient's name as a high-risk indicator of impersonation.
Detects cloud searches for sensitive keywords (credential, secret, etc.) followed by access to matching files.
This rule detects suspicious WebSocket upgrade attempts targeted at Microsoft authentication endpoints, typically used by 'Bluekit' or similar Phishing-as-a-Service (PhaaS) platforms to establish a persistent connection or tunnel for credential harvesting via adversary-in-the-middle attacks. It flags traffic from non-private IP addresses that exhibit specific patterns associated with proxy usage or automated tooling (e.g., Python/curl) combined with WebSocket upgrade headers.
This rule detects suspicious WebSocket upgrade attempts targeted at Microsoft authentication endpoints, typically used by 'Bluekit' or similar Phishing-as-a-Service (PhaaS) platforms to establish a persistent connection or tunnel for credential harvesting via adversary-in-the-middle attacks. It flags traffic from non-private IP addresses that exhibit specific patterns associated with proxy usage or automated tooling (e.g., Python/curl) combined with WebSocket upgrade headers.
Detects successful OAuth application consent events where the requested permissions include sensitive scopes such as Mail, Files, or User profile access. This is a common indicator of OAuth application-based phishing or persistence attempts, often referred to as 'Illicit Consent Grant' attacks.
Detects when a single user initiates a high volume (5 or more) of external guest user invitations within a one-hour window. This behavior can be indicative of reconnaissance or attempts to establish persistence by an compromised account by inviting external identities into the tenant.
This rule monitors for two distinct suspicious activities: 1) Inbound emails where the sender display name matches a list of executive titles, commonly indicative of Business Email Compromise (BEC) or executive impersonation attacks; 2) The creation of cloud service accounts with names mimicking administrative or IT support roles, which may indicate an adversary establishing persistent, privileged access.
Detects successful non-interactive token acquisitions using specific Microsoft first-party application IDs known to bypass Entra Conditional Access Policies through Nested App Authentication (NAA/BroCI). The detection specifically targets sign-ins to the Microsoft Graph resource.
Inbox Rule Notification Suppression
Cortex XDR
Detects the creation or modification of inbox rules designed to hide security and MFA notifications by deleting, marking as read, or moving them to hidden folders. This technique is commonly used post-compromise to suppress alerts about rogue device enrollment, sign-ins, or password changes, preventing the victim from discovering an account takeover. It is a frequent Business Email Compromise (BEC) and Account Takeover (ATO) persistence technique.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign leveraging compromised legitimate domains to bypass email authentication controls.
Identifies a single IP address (the attacker) accessing multiple distinct enterprise applications (Exchange, SharePoint, Teams) in rapid succession using a hijacked cookie.
Identifies high-volume password spray attacks against Microsoft 365 originating from RedVDS infrastructure by counting unique targeted accounts from a single IP. The rule specifically looks for invalid credential errors (50126, 50053) and triggers if more than 50 unique failed accounts are observed from a single IP address within a 15-minute window.
Detects the Kali365 framework automatically establishing mailbox rules to delete or hide security alerts, finance emails, or replies from the phished user. The rule specifically looks for the creation or modification of inbox rules that involve actions like 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead' and are applied to emails containing keywords such as 'phish', 'security', 'alert', 'finance', or 'invoice'.
Detects inbound invoice-themed phishing emails where the sender domain authentication (SPF/DKIM) fails, combined with healthcare-related display name impersonation. The rule specifically targets the abuse of aged, high-reputation domains used as a vector to bypass standard reputation-based email filtering while masquerading as healthcare organizations.
Detects queries extracting large contact lists or license details ($top=999 or $top=1000) via Microsoft Graph API, indicating automated data harvesting or reconnaissance activities. This behavior could be indicative of an adversary attempting to collect information about an organization's users or licensed software.
Page 104 of 150