Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This detection identifies when an email that contains a URL associated with a known Remote Monitoring and Management (RMM) tool was sent and subsequently clicked by the intended recipient or the original sender. The domain is not part of the organization's approved RMM solutions, indicating a potential use of Living-off-the-Land RMM (LOLRMM) techniques often employed in initial access or persistence stages by threat actors.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
Detects inbound external emails where the sender's display name exactly matches the recipient's display name. This is a common social engineering tactic used to create a false sense of familiarity, making the recipient more likely to trust the email and its contents. The rule specifically excludes legitimate self-sent emails where the sender's and recipient's email addresses also match.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
This rule detects when multiple versions of files are deleted within SharePoint by a single user. This could indicate an attempt to remove historical data or cover tracks.
This rule flags FIFA-related phishing emails from senders your organisation has never received mail from before. New senders plus urgent sports language is a common fraud pattern. Use multi-factor authentication on mail-linked accounts. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
Detects incoming emails containing hyperlinks to legitimate Microsoft device code authentication pages combined with keywords or spoofed branding for document sharing services like DocuSign, Adobe Acrobat Sign, or SharePoint. This technique is indicative of Kali365 and similar Phishing-as-a-Service (PhaaS) kits attempting to steal OAuth tokens and bypass MFA.
This rule detects emails containing multiple obfuscated URLs from common URL shortening services (bit.ly, tinyurl, short.link) originating from external senders. It specifically looks for emails with 3 or more such URLs within a one-hour window from the same sender.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
Detects inbound email that fails SPF authentication indicating email spoofing
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Detects bulk harvesting of Teams messages for credentials or sensitive data
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
Page 108 of 150