Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,865
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule detects suspicious activity where a user successfully performs a multi-factor authentication (MFA) device login to Microsoft Office 365 via a browser, and within a 15-minute window, the same user either creates a new inbox rule or adds a new device. This combination of events could indicate an adversary gaining initial access and then setting up persistence (e.g., forwarding emails) or further device enrollment.
This rule detects potential internal phishing campaigns by identifying newly observed sender domains that send emails to a large number of internal recipients within a short period. It looks for sender domains that have been seen for the first time within the last 7 days, have sent emails to more than 10 unique recipients, and have sent more than 5 emails in total. This behavior can indicate an attacker attempting to phish internal users from a newly created or compromised domain.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
Detects creation of malicious inbox rules via Exchange Web Services for persistence
This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This query visualises total emails with Spoof - DKIM fails summarizing the data daily.
This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
This rule detects potential spear phishing campaigns by identifying a high volume of emails (10 or more within an hour) from external senders (not @company.com) that contain keywords like 'password', 'account', or 'security' in the subject line, and also include either an attachment or a URL. This combination of factors suggests a targeted social engineering attempt.
This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
This rule detects emails containing multiple obfuscated URLs from common URL shortening services (bit.ly, tinyurl, short.link) originating from external senders. It specifically looks for emails with 3 or more such URLs within a one-hour window from the same sender.
This rule detects potential bulk phishing email campaigns by identifying a high volume of emails originating from external senders (not @company.com) with suspicious subject lines containing keywords like 'action required', 'verify account', or 'confirm identity'. The rule triggers if at least 50 such emails are sent to 20 or more unique recipients within a one-hour window.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
This rule detects potential Office 365 email account enumeration attempts via the Microsoft Graph API. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with URIs containing both '/users/' and '/mailboxSettings'. This pattern is indicative of an attacker attempting to discover valid user accounts and their mailbox settings.
Detects successful sign-ins to Microsoft Office applications using the device code flow (FOCI AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that originate from an untrusted network location. This activity can indicate a device code phishing attack where an adversary has tricked a user into authenticating a malicious application.
Detects addition of email delegate permissions for mailbox access persistence
Page 109 of 150