Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,864
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Detects disabling of Multi Factor Authentication.
Detects the addition of a new Federated Domain.
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
KQL Query from file: Admin consent for M365 Connector for Claude
KQL Query
Detects early-stage collection and reconnaissance activities targeting sensitive email data prior to exfiltration via Exchange cmdlets. This rule identifies the use of 'New-MailboxSearch' and 'Get-Recipient' cmdlets, which can be leveraged by adversaries to discover and collect email-related information. Detection covers both endpoint PowerShell execution and cloud audit logs for Microsoft Exchange Online.
KQL Query from file: M365 Connector for Claude Detection
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects emails where the subject line contains a 13-16 digit number, potentially indicating sensitive numerical patterns like a Credit Card. The rule looks for contiguous digits or common dashed/spaced credit card formats and filters out common automated email keywords to reduce false positives.
Detects emails where the subject line contains a 13-16 digit number, potentially indicating sensitive numerical patterns like a Credit Card. The rule looks for contiguous digits or common dashed/spaced credit card formats and filters out common automated email keywords to reduce false positives.
This rule detects emails that contain keywords related to 'civil id' in English or Arabic and subsequently extract potential Civil ID numbers from the email body. It then validates the extracted numbers based on birth month and day, and categorizes the risk level based on sender's domain and attachment count. This could indicate data exfiltration or sensitive information exposure.
Detects network activity consistent with a user attempting to download or install OpenClaw or a known variant — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for access to OpenClaw distribution URLs including GitHub releases, the install script endpoint, raw GitHub content, and npm registry paths for known variants. Also detects variant names appearing in process command lines at the time of a network connection, covering alternative package managers and runtimes such as Bun, pnpm, Yarn, and Deno in addition to traditional browsers and shell tools. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Detects Azure AD application registrations with redirect URIs pointing to known tunneling, reverse proxy, or attacker interaction/callback infrastructure. This can indicate an adversary attempting to establish persistence or exfiltrate data.
Detects installation and post-installation activity associated with OpenClaw and its known variants — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for npm global install commands, execution of shell installer scripts, OpenClaw-related binary or package files written to disk, and outbound network activity originating from known OpenClaw agent processes. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
This rule detects inbound emails from 'azure-noreply@microsoft.com' that are delivered to the inbox, are the first contact from this sender, and contain specific keywords in the subject line such as 'severity', 'activated', 'deactivated', 'alert', 'invoice', 'payment', 'order', or 'fund'. This could indicate phishing attempts or social engineering using a spoofed Microsoft sender to deliver urgent or financially-themed messages.
This rule detects suspicious device registration activity in Microsoft 365. It correlates users who have recently visited Microsoft device login or OAuth2 device authentication URLs with subsequent device registration events in Azure AD. This could indicate an adversary attempting to register a new device to bypass MFA or gain persistent access, potentially through device code phishing.
Detects phishing emails abusing legitimate Trello invitation notifications. This rule specifically looks for emails sent from 'invitation-do-not-reply@trello.com' with a subject line matching the pattern '<name> @ <org> invited you to their board <board>'. This pattern is recently observed being abused in phishing campaigns to trick users into clicking malicious links embedded within Trello boards.
This rule detects potential social engineering attempts in external direct messages (DMs) by identifying messages that impersonate IT helpdesk or support personnel, or discuss 'working from home' scenarios. It specifically looks for keywords like 'helpdesk', 'help desk', 'IT support', and 'working from home' in the recipient details or sender display name of external messages within the last 5 days. The goal is to surface lures that aim to trick users into revealing sensitive information or performing actions under false pretenses.
This rule detects rare external domains shared in Microsoft Teams messages that users subsequently click on. It identifies messages from external senders, extracts URLs and their domains, and then filters for domains that appear infrequently (less than 3 times in the last day). The rule then correlates these rare external domains with user click events within Teams, surfacing potential phishing attempts or malicious link sharing where users interact with untrusted content.
Page 114 of 150