Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,865
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects inbound emails containing links to the Upflow.io billing portal that include an embedded token parameter. This technique is actively abused by attackers to grant unauthorized viewing access to fraudulent invoices without requiring login credentials.
Detects a new mailbox rule that deletes, moves, redirects, or marks as read messages containing security, sign-in, MFA, alert, or administrator terms. This behavior is often indicative of an adversary attempting to hide their activities or prevent detection by preventing security notifications from reaching the user.
Detects the creation or modification of inbox rules that automatically mark emails as read and move them to a folder. This behavior is commonly used by adversaries to hide phishing replies or other malicious email activity from the victim's primary inbox.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
Identifies Python-based automated Graph API queries searching the directory based on name patterns and role attributes. This rule correlates sign-in logs with Microsoft Graph CloudAppEvents to detect suspicious activity originating from Python scripts interacting with the Microsoft Graph API.
This rule identifies rapid, multi-category reconnaissance activity against the Microsoft Graph API. It specifically looks for bursts of 20 or more requests across 4 or more unique Graph API endpoints within a one-minute window, particularly when those requests include parameters like '$top=999', '$count=true', or target '/beta/' endpoints, which are indicative of attempts to extract maximum data or use less common API versions. This behavior is typified by threat actors like Tycoon 2FA operators.
This rule detects suspicious administrative activities in Azure AD, Microsoft Graph, SharePoint, Exchange, or Teams when performed by accounts that are not explicitly identified as 'admin' or 'service' accounts. It looks for a combination of at least 5 operations and 2 unique operation types within a 2-hour window, targeting group, application, or service principal related resources. This could indicate an attacker using compromised non-privileged accounts to perform administrative actions or escalate privileges.
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
Detects a sender transmitting many attachment-bearing messages or a large aggregate attachment volume to external recipients within thirty minutes. This could indicate data exfiltration or a compromised account being used to send spam or malware.
Detects Graph API or SharePoint activity interacting with specific lists or a site GUID used by the jupyter-powerdev backdoor for Command and Control (C2) operations. This activity is indicative of the jupyter-powerdev malware leveraging SharePoint as a C2 channel.
Detects post-compromise inbox rule creation that moves security/phishing alerts to a folder and marks them as read. This behavior is often associated with adversaries attempting to hide their activities or prevent detection.
Detects an administrative content rule that combines strategic research or defence collection terms with an external BCC, forward, or redirect destination. GTIG reported that the Patroit rule matched subjects related to medical research, Chikungunya, artificial intelligence, cyber programmes, Indo-Pacific operations, defence, and uncrewed systems before silently forwarding the messages.
Detects hard deletion of mailbox data to remove forensic email evidence
This rule detects potential password spraying attacks against Microsoft Entra ID (formerly Azure Active Directory). It identifies a high number of failed sign-in attempts from a single source IP address targeting multiple unique user accounts within a short timeframe, specifically looking for 'Invalid password' or 'invalid credentials' failure reasons. The thresholds are set to 20 or more failures and 10 or more unique users within a 5-minute window.
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
Detects inbound email delivered from external Microsoft 365 tenants (@*.onmicrosoft.com) which may be attempting to impersonate legitimate senders. Threat actors register disposable or lookalike M365 tenants to abuse Microsoft's native SPF/DKIM authentication and bypass email security controls.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects a high volume of outbound emails originating from an internal Exchange server to external addresses with spoofed headers, indicating an Open Relay exploit.
Detects inbound emails that are fully authenticated (SPF, DKIM, DMARC pass) and contain keywords related to 'code of conduct', 'employee handbook', 'policy acknowledgement', or 'compliance update' in the subject line, originating from a sender domain that has not been observed by the recipient organization within the last 24 hours. This rule aims to identify potential phishing attempts leveraging social engineering themes from newly registered or previously unseen domains.
Page 106 of 150