Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects spearphishing emails targeting high-value executive recipients (CEO, CFO, etc.) that contain PDF attachments and use subject lines related to settlement or distribution agreements. The rule specifically looks for inbound traffic routed through Google Workspace (gappssmtp.com) infrastructure, indicating potential use of compromised legitimate domains to distribute malicious lures.
Detects external Microsoft Teams calls involving screen sharing and impersonation of trusted entities. This rule identifies high-risk credential theft or RAT installation vectors by filtering for calls where screen sharing occurs and the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or impersonates common trusted entities like 'microsoft', 'helpdesk', 'it.support', 'admin', 'security.team', 'apple', 'google', 'amazon', 'paypal', 'bank', etc.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects bulk download of Slack messages using the API
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs and flags potentially malicious user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node). It also categorizes user agents by risk level (HIGH, MEDIUM, NONE) and extracts relevant details like device IDs, IP addresses, and chat information. This activity can indicate post-compromise attackers using stolen tokens to silently export chat history.
This rule detects potential session token replay attacks against Okta by identifying a single Okta session (externalSessionId) being used from multiple distinct origins. It specifically looks for divergence in device identity (dtHash), operating system (OS), or client country within the same session, rather than just multiple IP addresses. This behavior is indicative of a stolen post-MFA cookie being replayed by an attacker.
This rule identifies potential account compromise by detecting successful logins to at least two different SaaS applications monitored by Microsoft Cloud App Security (MCAS) within a 2-hour window, originating from geolocations separated by more than 500 kilometers. This behavior is indicative of credential sharing or account hijacking where an adversary accesses multiple cloud services rapidly from geographically distant locations.
Detects high-risk activity where a user session, characterized by specific suspicious browser user agents and non-interactive authentication (indicative of token replay/session hijacking), is followed by changes to Workday payroll information (direct deposit, banking details) or unauthorized access to HR-related email content.
This rule monitors Microsoft Graph API audit logs for suspicious activity targeting user objects. It specifically detects attempts at bulk enumeration, use of pagination to circumvent limits, or searches using keywords associated with sensitive organizational data (e.g., payroll, finance, hr, admin).
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by identifying successful user sign-ins from a new, historically unseen IP address occurring within 30 minutes of a legitimate sign-in from a known IP, indicating the potential replay of a stolen session or refresh token.
This rule detects potential Adversary-in-the-Middle (AiTM) session hijacking by monitoring for successful multi-factor authentication (MFA) events on unmanaged or non-compliant devices, followed within 30 minutes by an API request from a geographically distant location. It includes logic to flag suspicious User-Agent strings often associated with automated AiTM tools.
Detects the transmission of potential sensitive information, such as passwords, tokens, API keys, or private keys, within Microsoft Teams chat messages by matching message content against a regular expression pattern for common credential formats.
Detects automated Microsoft Graph API requests originating from the 'axios/1.7.9' user-agent. This specific user-agent string is associated with the Payroll Pirate campaign, where threat actors (notably Storm-2755 and Storm-2657) employ scripted tools to enumerate directory information, specifically targeting HR and payroll personnel.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing TLDs, indicating potential phishing attempts or the use of Phishing-as-a-Service (PhaaS) infrastructure. The rule specifically targets one-on-one chats and filters for a broad list of suspicious top-level domains.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, specifically targeting behaviors associated with threat groups like BlackFile and Cordial Spider. The rule identifies these activities by filtering Okta SSO raw logs for specific event types related to MFA and device management, and then correlating them with known proxy ASN organizations or Okta's internal proxy flags.
This rule detects successful authentication attempts directed at network devices from sources not explicitly marked as authorized management systems. It identifies users or systems that are not recognized service accounts authenticating against network infrastructure and flags activity that involves multiple unique destination targets as high risk.
This rule detects the creation or modification of inbox rules in Office 365 that involve email forwarding or redirection to external domains. It calculates a risk score based on whether the action occurred outside of typical business hours (08:00-18:00 local time/weekends) and whether the user is performing this action from a previously unseen IP address, which may indicate a compromised account attempting to exfiltrate or redirect emails.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
Detects attempts to exfiltrate data through Microsoft Copilot Enterprise Search by identifying URL clicks containing specific keywords ('extract', 'embed', 'img') in the query parameters. This could indicate an adversary trying to extract sensitive information or embed malicious content.
Page 106 of 142