Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects application consent by a user shortly after the same account clicked a code-of-conduct or compliance-themed message. This behavior can indicate a multi-stage phishing campaign where a user is lured into clicking a malicious link (e.g., a fake policy document) and subsequently grants OAuth permissions to a malicious application.
Detects phishing emails leveraging Telephone-Oriented Attack Delivery (TOAD). These emails impersonate Scotiabank and use urgent themes regarding unauthorized $3,000 Interac e-Transfers to lure victims into calling an attacker-controlled toll-free number. The rule monitors for specific email subjects and attachments masquerading as voicemail audio files (v-mail*.mp3.eml or v-mail*.html).
Detects a suspicious pattern where a highly privileged on-premises synchronized user account signs into Azure Active Directory (Entra ID) and immediately performs sensitive administrative actions (role assignment or OAuth application consent grant) within a 30-minute window. This behavior is indicative of credential abuse by the Storm-2372 actor to escalate privileges within a tenant.
Detects bulk reconnaissance against multiple Microsoft Graph API endpoints (users, groups, roles, etc.) by scripting clients, correlated with a recent device registration event by the same user principal. This behavior is indicative of a Storm-2372 conditional access bypass strategy followed by rapid directory environment enumeration.
Detects malicious npm package propagation indicative of the Miasma/Mini Shai-Hulud worm. The rule identifies suspicious patterns in AuditLogs, specifically burst npm publishes by known malicious actors or involving known malicious package names, as well as the use of weaponized GitHub Actions workflows or unauthorized snapshot branches.
This rule detects potentially malicious emails that leverage Calendly as a lure. It looks for emails that pass standard authentication (SPF/DKIM/DMARC) but contain suspicious elements such as URLs redirecting to Calendly or Google, subject lines related to common social engineering themes (complaints, health inspections, etc.), or the presence of ZIP attachments that match common photo/image naming patterns.
This rule detects suspicious emails exhibiting patterns associated with 'authentication laundering' by identifying the combination of legitimate scheduling or redirection links (e.g., Calendly, Google Redirect) with potentially malicious indicators such as zip file links, suspicious .cfd domains, or impersonation of booking management services. It calculates a laundering score based on these features and the health of email authentication signals (SPF/DKIM).
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies specific malicious attachment filenames, suspicious URLs, subject lines, and sender domains commonly used in these campaigns to deliver malicious content.
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign using compromised legitimate domains to bypass email authentication controls.
Detects registration of new MFA devices potentially for authentication bypass
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824).
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation. This behavior is indicative of an attacker using a stolen device code to register a new device, thereby gaining persistent access to the user's account.
Detects emails containing Microsoft Customer Voice URLs that redirect to known cloud-hosting platforms (vercel.app, amplifyapp.com, workers.dev) frequently used for phishing campaigns. This indicates an attempt to leverage legitimate Microsoft services to host or redirect to malicious content.
Identifies inbound emails leveraging the HR-themed "Code of Conduct" or "Employee Policy" subjects often used to trigger the AiTM campaign.
Detects phishing emails associated with the TONResolver RAT campaign that impersonate Booking.com partner support. The emails use Japanese-language lures concerning guest complaints, include 'invite.ics' calendar attachments, and contain URLs pointing to suspicious top-level domains (.cfd, .bond, .sbs, .shop) or specific 'photo-' URL patterns. The rule differentiates between malicious impersonation and legitimate booking.com domain traffic.
Detects a single new session identifier accessing Exchange, SharePoint, and OneDrive within a short period, which may indicate broad post-authentication collection following an adversary-in-the-middle (AiTM) attack.
Detects a rapid burst of file upload activity to cloud storage applications from a single account, including unusual proxy or device context. This rule identifies scenarios where an account performs 20 or more upload events or uploads 20 or more distinct objects within a 15-minute time window to common cloud storage services like Google Drive, Dropbox, Box, MEGA, OneDrive, or ShareFile. It also highlights if any of these uploads originate from an anonymous proxy.
Detects a newly replayed session issuing mailbox searches for invoice, payment, password, security, or confidential terms. This rule is designed to identify suspicious activity indicative of session hijacking or credential compromise, where an attacker uses a replayed session to search for sensitive information within a mailbox or SharePoint.
Detects attempts to modify or delete Conditional Access Policies in Microsoft Graph. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
This rule monitors for suspicious emails involving the 'gasparinutrition.com' domain, specifically looking for indicators such as DMARC failures, spoofed display names (e.g., 'monitoring'), or attachments with file names related to business documents like distribution, settlement, or agreements. It also triggers on DNS queries for the same domain, which could indicate related outbound communications or C2 activity.
Page 119 of 179