Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects potential phishing attempts by identifying emails with subject lines and attachment names related to Income Tax or official tax filings. The detection logic correlates indicators such as specific tax-related subject phrases, common tax utility attachments, suspicious URLs (govtop.one), and sender spoofing (impersonating 'Government of India' without a valid .gov.in domain).
User Added to an Administrator's Azure AD Role
Identifies when a application is deleted in Azure.
Identifies when a device in azure is no longer managed or compliant
Identifies when a service principal was removed in Azure.
Detects HTTP requests to Microsoft 365 search endpoints containing unusually long query strings. Such patterns may indicate automated data extraction, exfiltration over alternative protocols, or unauthorized information harvesting via search parameters.
This rule detects potentially malicious search queries within Microsoft 365 or Copilot-related URLs intercepted by email gateways, proxies, or SIEM sources. It monitors for suspicious query parameters that may indicate attempts to hide malicious content, such as HTML tags (e.g., <img>), image-related keywords, or excessively long query strings, which could be indicative of phishing attempts or browser-based exploitation techniques.
This rule detects potential Server-Side Request Forgery (SSRF) exploitation where Bing's 'search by image' functionality is abused to fetch external, non-Microsoft controlled URLs. The query monitors web proxy logs for specific Bing search parameters ('cbir=sbi' and 'imgurl') and filters out requests to trusted domains, effectively identifying attempts to use the search engine as an intermediary for unauthorized external web requests. The rule further correlates these hits with Microsoft Copilot interaction logs to identify if the activity is associated with authenticated Copilot user sessions.
This rule detects potentially malicious email attachments masquerading as 'Distribution Settlement Agreements'. It flags PDF attachments that match these specific filenames when delivered in emails associated with identified suspicious domains (gasparinutrition.com, gappssmtp.com) or when authentication checks like DMARC fail.
Detects the SearchLeak (CVE-2026-42824) exploit, where an attacker uses a prompt-injected M365 Copilot URL to force the assistant to search the victim's mailbox for sensitive authentication information such as MFA codes, OTPs, or security passcodes. The rule correlates an external HTTP request containing the malicious URL with a subsequent Exchange search query initiated by the Copilot service within a 2-minute window.
Detects external Microsoft Teams calls involving screen sharing and impersonation of trusted entities. This rule identifies high-risk credential theft or RAT installation vectors by filtering for calls where screen sharing occurs and the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or impersonates common trusted entities like 'microsoft', 'helpdesk', 'it.support', 'admin', 'security.team', 'apple', 'google', 'amazon', 'paypal', 'bank', etc.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
This rule detects enumeration of directory roles (specifically targeting privileged roles like Global Administrators) in Azure AD/Microsoft Entra ID, correlated with sign-in activity originating from IP addresses outside of defined corporate network ranges. This behavior is indicative of reconnaissance activities by an adversary who has gained initial access via a compromised identity.
Detects potential exploitation of CVE-2025-0309, where the Intune Company Portal application identifier is used to acquire Microsoft Graph tokens via a password grant mechanism while bypassing Multi-Factor Authentication (MFA). This technique typically relies on exploiting misconfigured Conditional Access policies that exclude the Intune resource from mandatory MFA enforcement.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs and flags potentially malicious user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node). It also categorizes user agents by risk level (HIGH, MEDIUM, NONE) and extracts relevant details like device IDs, IP addresses, and chat information. This activity can indicate post-compromise attackers using stolen tokens to silently export chat history.
This rule identifies potential account compromise by detecting successful logins to at least two different SaaS applications monitored by Microsoft Cloud App Security (MCAS) within a 2-hour window, originating from geolocations separated by more than 500 kilometers. This behavior is indicative of credential sharing or account hijacking where an adversary accesses multiple cloud services rapidly from geographically distant locations.
Detects when a new federated identity credential is successfully added to an Azure Active Directory (Entra ID) application. This activity is a common method for attackers to establish persistent access to cloud resources by bypassing password-based authentication.
Detects incoming phishing emails that impersonate healthcare-related organizations. The detection identifies malicious activity by matching common healthcare-themed domain patterns in the From header, coupled with email authentication failures (DMARC or DKIM), and a mismatch between the envelope sender and the header From address. It also monitors for invoice-themed subject line lures commonly used in social engineering.
Detects internal emails with subject or body content related to payroll information changes (e.g., direct deposit, bank account redirection) sent to HR or payroll-related email addresses or recipients. This behavior is indicative of internal Business Email Compromise (BEC) or an attempt by an attacker (or compromised insider) to facilitate payroll fraud.
Detects high-risk activity where a user session, characterized by specific suspicious browser user agents and non-interactive authentication (indicative of token replay/session hijacking), is followed by changes to Workday payroll information (direct deposit, banking details) or unauthorized access to HR-related email content.
This rule monitors Microsoft Graph API audit logs for suspicious activity targeting user objects. It specifically detects attempts at bulk enumeration, use of pagination to circumvent limits, or searches using keywords associated with sensitive organizational data (e.g., payroll, finance, hr, admin).
Page 107 of 179