Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule identifies phishing emails containing multiple distinct redirect hops across various cloud hosting platforms (e.g., Azure Websites, Firebase, CloudFront). It flags emails as suspicious if they contain URLs from multiple monitored cloud platforms, indicating a likely bulletproof redirect chain, and correlates these emails with click data. It elevates the severity for emails sent to privileged user accounts such as admins, executives, or finance staff.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824). Specifically looks for HTML image tags (<img src=), the variable '$TITLE', or the Bing SSRF endpoint 'bing.com/images/searchbyimage' within the URL-decoded 'q' parameter.
Identifies when a owner is was removed from a application or service principal in Azure.
Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
This rule monitors for two distinct suspicious activities: 1) Inbound emails where the sender display name matches a list of executive titles, commonly indicative of Business Email Compromise (BEC) or executive impersonation attacks; 2) The creation of cloud service accounts with names mimicking administrative or IT support roles, which may indicate an adversary establishing persistent, privileged access.
This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.
Detects inbound emails from 'gmail.com' where the sender's display name closely matches the recipient's local username part. This pattern is commonly used in business email compromise (BEC) and phishing attacks to impersonate colleagues or known contacts.
Detects anomalous device registration in Azure AD where a device code flow is used to authenticate to the Device Registration Service (DRS) and the resulting device is registered with an 'Unknown' or 'Linux' operating system. This behavior is indicative of an adversary, such as Storm-2372, using tools like AADInternals to perform phantom device registration to bypass conditional access policies by simulating a device without TPM attestation.
Detects emails containing embedded PNG, SVG, or JPG images (often QR codes) that are used in conjunction with a subject line indicating 'Code of Conduct' to bypass text-based URL filters and redirect users to an AiTM (Adversary-in-the-Middle) proxy. This technique is commonly used in phishing campaigns to steal authentication tokens.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects suspicious user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) attacks, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies 'axios/1.13.x' (credential relay variant) and 'node/undici' (device code variant) user agents in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies emails containing malicious PDF attachments (e.g., 2026-0610-1.pdf) or directing users to the known phishing domain 'govtop.one', commonly used to harvest credentials or deliver malware.
This rule monitors email metadata for patterns associated with known phishing campaigns mimicking Booking.com. It looks for specific lures in email subjects, suspicious attachment filenames such as 'invite.ics', malicious domains using the .cfd TLD, or body text containing 'Download Photos and Videos'.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
Detects email thread fabrication by the Latin-placeholder phishing kit, which embeds specific, non-business job titles and recipient-domain email addresses into the message body to manufacture the appearance of legitimate internal correspondence.
Page 114 of 179