Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
Detects high-volume, potentially automated enumeration of Microsoft Graph API endpoints targeting sensitive personnel data (payroll, HR, finance). This rule identifies requests using non-standard or suspicious user agents—such as curl, python-requests, or common web client patterns—when interacting with user and group directories in the Microsoft 365 environment, characteristic of the 'Payroll Pirate' (Storm-2755/Storm-2657) campaign patterns.
Detects incoming emails containing suspicious legal-themed subjects (e.g., subpoenas, copyright infringement) from Gmail domains that include shortened URLs (e.g., bit.ly, goo.gl). The rule also checks for successful SPF or DKIM authentication results, which are common in mass phishing campaigns to bypass initial spam filters.
Identifies when a service principal is created in Azure.
Detects potential SearchLeak (CVE-2026-42824) prompt-to-parameter injection in Microsoft 365 Copilot Enterprise. The rule monitors for search operations containing URL-encoded characters, HTML/JS injection payloads, or anomalous long query strings that indicate a malicious attempt to influence search results or exfiltrate data.
Detects outbound proxy requests to the Bing Search-by-Image endpoint where the imgurl parameter is used to perform a server-side request forgery (SSRF). Attackers use this to bypass security controls by forcing Microsoft services to fetch an external, malicious URL containing exfiltrated data within the path, as seen in the SearchLeak (CVE-2026-42824) exploit chain.
Detects a suspicious pattern where a user successfully authenticates via MFA, followed by another successful sign-in attempt for the same account within 10 minutes using a different IP address or user agent. This behavior is often indicative of session hijacking or adversary-in-the-middle (AiTM) attacks where a session token is stolen and replayed from an attacker-controlled environment.
This rule monitors for potential spearphishing campaigns by tracking two behaviors: the delivery of emails containing known malicious URLs or lure-themed attachment names via email gateway logs, and the subsequent execution of files extracted from archives or matching lure patterns by EDR agents on endpoints.
This rule detects potentially malicious spearphishing emails containing suspicious file types (such as executables, scripts, or archives) that are sent with either a spoofed sender domain or a subject line containing common lures targeting IT/infrastructure teams. It focuses on identifying high-risk email deliveries that indicate social engineering and initial access attempts.
Detects enumeration of Entra ID (Azure AD) users, groups, devices, and service principals using the Microsoft Graph API, specifically when performed by tools like AzureHound or Roadtx. The detection focuses on activity originating from sign-ins that bypassed MFA, potentially leveraging a hidden CA policy scope exclusion (CVE-2025-0309). The rule identifies suspicious user agents and a high volume of requests to multiple Graph API enumeration endpoints.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
This rule detects potential post-compromise mailbox reconnaissance by correlating suspicious sign-in events (non-interactive or unmanaged device usage, often associated with AiTM token replay) with subsequent mailbox or compliance search operations targeting payroll and HR-related keywords within a 60-minute window.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Page 104 of 179