Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects when a single user initiates a high volume (5 or more) of external guest user invitations within a one-hour window. This behavior can be indicative of reconnaissance or attempts to establish persistence by an compromised account by inviting external identities into the tenant.
Detects successful OAuth application consent events where the requested permissions include sensitive scopes such as Mail, Files, or User profile access. This is a common indicator of OAuth application-based phishing or persistence attempts, often referred to as 'Illicit Consent Grant' attacks.
This rule detects when sensitive administrative roles are assigned directly to users in Microsoft Entra ID (formerly Azure AD) without utilizing the Privileged Identity Management (PIM) service. Direct assignment of these roles bypasses the security controls and JIT (Just-In-Time) access workflows enforced by PIM, potentially indicating unauthorized privilege escalation or a misconfiguration.
Detects the creation or modification of inbox rules in Exchange/Office 365 that both apply an email suppression action (move to folder, delete, or mark as read) and filter for security-themed keywords (e.g., 'phish', 'MFA', 'SOC'). This behavior is commonly used by adversaries to hide security alerts, multi-factor authentication (MFA) prompts, or phishing incident notifications from a compromised user's mailbox.
Detects instances where a guest user is invited to the organization using an email address from potentially malicious TLDs (e.g., .ru, .cn, .ir, .kp) or a domain structure that is represented as an IP address. These patterns are often associated with phishing, reconnaissance, or adversary attempts to gain a foothold in an environment by inviting external identities.
Detects the creation or modification of inbox rules in Exchange/Office 365 that both apply an email suppression action (move to folder, delete, or mark as read) and filter for security-themed keywords (e.g., 'phish', 'MFA', 'SOC'). This behavior is commonly used by adversaries to hide security alerts, multi-factor authentication (MFA) prompts, or phishing incident notifications from a compromised user's mailbox.
Detects any modification (add, update, or delete) to Entra ID cross-tenant access settings. Adversaries may manipulate these trust configurations to weaken inbound security restrictions, establish unauthorized access between tenants, or facilitate cross-tenant impersonation.
This rule detects any activity within Office 365 logs that includes a 'username' field and then projects a SHA256 hash of a 'file.exe'. While the specific detection logic is incomplete, it indicates an attempt to correlate Office 365 user activity with file execution or manipulation, potentially for forensic analysis or to identify suspicious file interactions.
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
This rule detects AI-generated phishing campaigns characterized by a high degree of attachment polymorphism. It identifies instances where a single campaign (based on sender domain or subject schema) delivers HTML attachments with a unique SHA256 hash to each recipient, indicating an attempt to evade traditional signature-based detection.
Detects phishing emails utilizing Kali365's hardcoded subject line templates impersonating file sharing services like SharePoint and DocuSign. The rule specifically looks for emails with subjects starting with "SharePoint - Document Shared:" or "DocuSign - Signature Required:" where the sender's domain is not microsoft.com or docusign.com, indicating a potential spoofing attempt.
Detects MFA device registration occurring during a suspicious session heavily focused on HR portal access. This rule correlates MFA registration events with access to HR applications like Workday or ADP within a 10-minute window, indicating potential account takeover or unauthorized access attempts.
This rule detects potential business email compromise (BEC) activity where a compromised mailbox is used to send internal phishing emails or fraudulent invoices to financial departments. It identifies emails sent internally with subjects containing keywords like 'Invoice', 'Payment', 'Wire Transfer', or 'Updated Account', and correlates them with email sending events from cloud applications.
Detects rapid enumeration of SharePoint sites, drives, lists, and document libraries from one account, which can precede targeted data collection. This rule identifies a high volume of GET requests to SharePoint-related URIs within a short timeframe, indicating potential reconnaissance or data exfiltration attempts.
Detects attempts to upload files to the SharePoint master page gallery using a POST request. This activity can be indicative of an attacker attempting to establish persistence or deface the SharePoint site by modifying its core components. The rule specifically looks for requests to '_layouts/15/Upload.aspx' or '_layouts/Upload.aspx' with 'RootFolder' and 'List' parameters containing '_catalogs/masterpage' or directory traversal sequences ('../').
This rule detects highly suspicious email attachments that mimic voicemail notifications, specifically targeting Scotiabank users. It identifies emails with attachments named like 'v-mail_*.mp3.eml' or ending with '.mp3.eml' where the attachment's MIME type is 'application/html'. The rule also looks for specific subject line keywords related to Scotiabank, Interac, e-Transfer, unauthorized activity, or a specific monetary value ('3,000'), and checks for an approximate file size of 6000-9000 bytes, consistent with known phishing lures.
This rule detects programmatic file downloads from SharePoint and OneDrive using various automation tools and SDKs, rather than typical browser access. It specifically looks for `FileDownloaded`, `FileSyncDownloadedFull`, `FileAccessed`, or `FilePreviewed` operations within SharePoint or OneDrive audit logs where the user agent string indicates the use of PowerShell, PnP, Microsoft Graph SDK, Python, Node.js, or common command-line tools like curl or wget. This behavior can be indicative of data exfiltration.
Detects an inbound policy-themed PDF attachment whose extracted URLs lead to a sign-in, authentication, review, or acknowledgement workflow outside the organisation. This rule specifically looks for PDF attachments in emails where the subject contains terms like 'code of conduct', 'policy', 'compliance', or 'handbook', and the extracted URLs within the PDF contain keywords such as 'login', 'signin', 'auth', 'review', or 'acknowledge'.
This rule detects email-based phishing attempts that utilize a two-hop open-redirect mechanism by abusing legitimate SaaS platforms (holabrief.com and loopedin.io). It flags emails containing specific redirect links, often used to bypass traditional security filters by redirecting users through trusted domains before reaching a malicious destination.
This rule monitors inbound emails that exhibit signs of phishing, specifically looking for failures in email authentication protocols (DKIM, DMARC), the use of specific invoice-themed subject lines, and the inclusion of redirection links pointing to known third-party collaboration platforms (HolaBrief, LoopedIn). It also identifies cases where the sender's envelope domain differs from the header's 'From' domain, which is a common indicator of email spoofing used in identity-based attacks.
Detects inbound phishing emails that fail both DKIM and DMARC checks, contain invoice-themed subject lines, and include links pointing to known open-redirect infrastructure (holabrief.com or loopedin.io). This pattern is consistent with credential harvesting campaigns using multi-hop SaaS redirects.
Page 117 of 179