Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,865
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects successful device code authentication via the Microsoft Office App (FOCI), which could indicate potential Adversary-in-the-Middle (AiTM) phishing attacks. The rule specifically looks for successful sign-ins using the 'deviceCode' authentication protocol and the AppId associated with Microsoft Office.
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
Identifies Azure Active Directory (AAD) logins from new or unusual locations followed immediately by the creation of inbox rules designed to delete incoming emails. This behavior is indicative of an attacker gaining access to an email account and attempting to disrupt communication or hide their activities by automatically deleting legitimate emails.
Identifies emails where SenderFromDomain matches an internal legitimate domain, but the SenderIPv4 originates from an unassociated external network exploiting permissive SPF records or dangling DNS. This rule specifically looks for emails with a sender domain matching 'yourcompany.com' (which should be replaced with the actual tenant domain), where the sender's IPv4 address is not from internal networks (excluding 10.0.0.0/8 and 192.168.0.0/16), and the SPF authentication passed. It further ensures that the originating IP address is not known to internal devices via network connection events, helping to filter out legitimate internal mail relays or services.
Tracks AAD/Exchange logs showing mail routed through an external tenant specifically to bypass internal domain spoofing filters via trusted connectors. This rule identifies emails where the sender's domain matches the internal company domain, but the email was routed through an external Office 365 connector and did not originate from a trusted internal IP address, indicating a potential cross-tenant spoofing attempt.
Detects a compromised account performing heavy Graph API searches for HR personnel to socially engineer IT/Helpdesk. Specifically, it looks for search queries containing terms like 'HR', 'Human Resources', or 'Payroll Manager'.
Identifies emails where the From header spoofing a government entity mismatches the envelope sender in MailEvents. This indicates a potential email spoofing attempt, often used in phishing campaigns.
Detects the creation or modification of an inbox rule in Microsoft 365 where the rule's name consists entirely of special characters. This behavior can be indicative of an adversary attempting to evade detection by obscuring malicious inbox rules.
Detects Tycoon 2FA operator recon assessing mailbox forwarding rules, auto-replies, and timezones. This KQL query identifies actions related to 'mailboxSettings' within 'Microsoft Graph' events, which can indicate an adversary enumerating user mailbox configurations.
Detects incoming phishing emails leveraging Scotiabank and Interac branding for Telephone Oriented Attack Delivery (TOAD). These emails utilize HTML attachments or body content containing specific toll-free numbers (1-800-472-6) and financial lures related to unauthorized Interac e-Transfers, aiming to deceive recipients into initiating a callback.
Detects a spear-phishing email masquerading as AWS Support services originating from a specific compromised university account (awsservices@presby.edu). This rule identifies malicious emails associated with the PoisonSeeds AiTM (Adversary-in-the-Middle) phishing campaign, which uses support ticket lures to harvest credentials.
Identifies email attachments with a specific naming convention ('Agreement Settlement [Target] May [Day], 2026.pdf') used in a credential harvesting campaign. This rule looks for PDF files starting with 'Agreement Settlement' and ending with '.pdf', with a specific date format for May 2026.
Detects inbound spearphishing emails impersonating Scotiabank with Interac e-Transfer financial urgency lures targeting executive/VIP mailboxes from first-time external senders, with multiple variants delivered within one hour.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
Detects an administrative forwarding, redirect, BCC, or content compliance rule change when Defender for Cloud Apps identifies attributes that are uncommon for the account. UNC6508 replayed harvested credentials to access an administrator account before creating its covert exfiltration rule. The anomaly requirement increases confidence while preserving coverage for infrastructure that is not recognised as a proxy.
Detects bursts of Microsoft Graph API calls hitting multiple distinct reconnaissance endpoints within a 60-second window. This behavior can indicate an adversary performing rapid enumeration or discovery within a Microsoft 365 environment.
Detects Graph API queries targeting getResourceTenants, identifying lateral movement preparation. This activity can be indicative of an adversary attempting to enumerate tenant relationships within Microsoft Graph to understand the environment and potentially identify targets for further compromise or lateral movement.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects inbound email events that impersonate Scotiabank, contain financial urgency lures related to Interac e-Transfers, and include suspicious HTML attachments or .eml files. The rule specifically looks for HTML attachments or .eml files with specific naming conventions ('v-mail_' prefix or '.mp3.eml' suffix) and a file size between 7KB and 8KB, or any HTML attachment. It also checks for sender display name impersonation of Scotiabank while the sender's actual domain is not scotiabank.com.
Page 105 of 150