Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,865
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects sign-ins to M365 using the default Node.js user agent, indicative of the Tycoon 2FA kit relay tier.
This rule processes Microsoft Graph Security Alerts, aggregating evidence from various Microsoft Defender products (MDE, MDI, MDCA, MDO, Entra ID Protection). It extracts and normalizes detailed evidence related to devices, users, IP addresses, processes, files, URLs, emails, mailboxes, network connections, and Azure resources, providing a comprehensive view of security incidents across the Microsoft ecosystem.
This rule detects potential password spraying attacks against Microsoft Entra ID (formerly Azure Active Directory). It identifies a high number of failed sign-in attempts from a single source IP address targeting multiple unique user accounts within a short timeframe, specifically looking for 'Invalid password' or 'invalid credentials' failure reasons. The thresholds are set to 20 or more failures and 10 or more unique users within a 5-minute window.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
Identifies emails where the sender claims to be internal, but the X-MS-Exchange-Organization-AuthAs header is not set to 'Internal', indicating a potential Ghost-Sender exploit. This rule focuses on delivered emails to reduce noise and filters out expected external mail gateways and trusted automated senders.
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects inbound emails containing Google Forms links with the '/edit?invite=' parameter. This parameter grants editor privileges and is frequently abused in data harvesting campaigns to bypass traditional email gateway URL filtering.
Detects hard deletion of mailbox data to remove forensic email evidence
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
Detects bulk downloading of SharePoint document libraries
This rule detects when an OAuth application is granted tenant-wide administrative permissions within a Microsoft 365 environment. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing 'oauth2PermissionGrants'. This activity is indicative of a malicious OAuth app attempting to gain broad access to an organization's data and resources, often as a persistence mechanism.
Identifies inbound emails claiming to be from an internal domain where the sender IP does not match the expected authorized third-party MX record or spam filter IP addresses. This rule focuses on emails successfully delivered to the user, where the sender domain claims to be one of the organization's internal domains, and the sending IP is not among the expected external MX or spam filter IP addresses.
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
Detects the creation of a new Global Administrator or Company Administrator account, which may occur after an attacker compromises an Intune administrator to establish persistence and cement full control over the tenant.
Detects creation of inbox rules to hide attacker communications from victim
This rule detects potential direct send email spoofing attempts where an email fails SPF, DKIM, and DMARC authentication checks, but passes Composite Authentication (CompAuth). Additionally, it looks for emails where the sender's local part (username before the @) matches the recipient's local part, suggesting an attempt to impersonate an internal user. The rule also filters out emails that were blocked and those sent via internal connectors, focusing on external spoofing attempts. It further excludes emails originating from specific countries (New Zealand, Australia) which can be customized.
Page 107 of 150