Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of distinct mailboxes belonging to other users. 2) Identifies users accessing a high number of distinct folders within another user's mailbox. Both parts are designed to flag potential unauthorized access, data exfiltration, or reconnaissance activities within an Exchange Online environment.
This query detects suspicious sign-in activity from a user who has recently clicked on a phishing link. It correlates email click events with sign-in logs, identifying sign-ins from new or infrequent IP addresses after a user has interacted with a suspicious email. The rule uses configurable parameters for sender email addresses, sender domains, and subject keywords to identify phishing emails.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
This rule detects inbound emails classified as phishing or malware by the email security system. It summarizes the total number of such messages, provides sample subjects, and counts how many were blocked, delivered to mailboxes, junked, or had other actions. The rule specifically focuses on emails that were delivered to a mailbox, indicating a potential bypass of initial security measures or a need for further investigation.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
Azure Device Code OAuth Consent
Cortex XDR
This rule detects suspicious activity related to Microsoft 365 Device Code OAuth consent flows. It specifically looks for device code authentications that are single-factor or lack MFA, and then groups these by IP address and client application. The rule identifies suspicious patterns such as a high number of logins, unique users, or unique applications from a single IP address, or rapid login attempts within a short timeframe, which could indicate enumeration or phishing attempts.
Detects phishing emails containing QR codes rendered using HTML tables. This technique is used to evade image-based scanning and OCR security controls by representing the QR code as a grid of small, colored table cells (<td>) instead of a traditional image file.
This rule detects inbound emails that appear to be Microsoft Teams invitations but contain suspicious keywords in the subject line related to financial transactions (invoice, billing, payment, renewal, charge). This could indicate a phishing attempt where adversaries leverage legitimate-looking Microsoft invitation emails to deliver financially themed lures.
Detects suspicious email inbox rule creation indicative of account compromise. Focuses on rules with randomly-generated names or rules that move emails to low-visibility folders combined with hiding actions (mark as read, delete, stop processing).
This rule detects potential malicious email campaigns by identifying when multiple users submit email reports (e.g., phishing or spam) that share common entities such as sender IP, primary sender address/domain, secondary sender address/domain, or subject line. A configurable threshold determines the minimum number of distinct reports required to flag an entity as suspicious.
Detects successful Microsoft 365 sign-ins using the OAuth 2.0 device code grant flow for applications with low prevalence. This technique is used by threat actors to gain unauthorized access to accounts, bypassing some MFA controls.
This KQL Query helps to understand all the URL Redirections from URLs received by Email using the UrlChainId identifier on KQL that groups together all URLs that belong to the same “click/redirect chain”. When an message contains a URL, that URL may redirect through several intermediate URLs (trackers, shorteners, phishing, etc.) before land on the final site. KQL builds a URL chain from the original URL in the email through each redirect hop. All URLs that are part of a single chain share the same UrlChainId and for each hop. On the other hand, UrlChainPosition register the position of every URL, the original one = value 0 and the other redirections tagged with next numbers(1, 2, etc. ) The following query includes different options to classify the insights into four categories:
Tracking Domains
Redirecting to Different Countries
Redirecting to Different Domains
Number of Redirections
Tracking Domains
Redirecting to Different Countries
Redirecting to Different Domains
Number of Redirections
This detection identifies emails linked to a recent widespread phishing campaign that abuses trusted Microsoft SharePoint links to bypass traditional security controls. Attackers use convincing business emails containing SharePoint URLs that lead to multi-step validation pages, mimicking legitimate Microsoft authentication flows. These techniques make the attacks highly deceptive and harder to detect, as the initial links appear legitimate.
This campaign has been active and prevalent over the past two weeks, targeting multiple organizations and leveraging user trust in Microsoft services to harvest credentials.
Use this query to find potential malicious SharePoint links in email messages and investigate them further by detonating the URLs in a sandbox environment to analyze their behavior.
This campaign has been active and prevalent over the past two weeks, targeting multiple organizations and leveraging user trust in Microsoft services to harvest credentials.
Use this query to find potential malicious SharePoint links in email messages and investigate them further by detonating the URLs in a sandbox environment to analyze their behavior.
Detects a high volume of Microsoft Teams invitation emails sent to multiple users within the organization. This could indicate a reconnaissance attempt or a widespread phishing campaign where an attacker is trying to lure users into a malicious external tenant, bypassing some internal security controls.
Detects when a Microsoft Teams messaging policy is modified to allow users to send B2B invitations to external users ('UseB2BInvitesToAddExternalUsers' set to 'True'). While this can be a legitimate administrative change, it can also be an indicator of misconfiguration or malicious activity to enable phishing attacks by luring users to malicious external tenants where organizational security controls do not apply.
Detects emails containing URLs with patterns characteristic of the Tycoon 2FA phishing kit. These URLs often contain a base64-encoded email address in the path, preceded by a special character.
This rule identifies emails sent from an internal employee email address to external personal email domains where the recipient's local part of the email address contains tokens from the sender's display name for more than 0 words matching. It also analyses attachments for sensitive keywords (e.g., 'confidential', 'secret') and assigns a risk score based on factors like email volume, attachment count, and presence of sensitive attachments. This could indicate an attempt to exfiltrate sensitive company data to a personal account.
It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
Query sign-ins with MFA success immediately following multiple failed sign-ins from different regions. Potential session hijack or AiTM (Adversary-in-the-Middle).
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
This rule detects emails or URL click events containing a specific pattern associated with 'quantum.php' within the URL. This pattern is often indicative of phishing attempts, particularly those designed to harvest credentials or deliver malware.
* Compare distances and times of consecutive sign-ins for the same user.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
Page 118 of 150