Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects Entra ID guest (B2B) users performing a sign-in from a previously unseen IP address or country (observed over the last 30 days), followed within a 4-hour window by sensitive file operations in SharePoint, OneDrive, or Teams (e.g., file downloads, exports, or sensitivity label changes). This pattern is indicative of potential account takeover or unauthorized access to sensitive corporate data.
This rule identifies potential account compromise by detecting successful logins to at least two different SaaS applications monitored by Microsoft Cloud App Security (MCAS) within a 2-hour window, originating from geolocations separated by more than 500 kilometers. This behavior is indicative of credential sharing or account hijacking where an adversary accesses multiple cloud services rapidly from geographically distant locations.
Detects the creation or modification of Named Locations within Conditional Access policies that include IP ranges. This behavior could indicate an attacker whitelisting their own IP addresses to maintain persistence or bypass Conditional Access security controls. The rule correlates changes with administrative context, such as non-standard business hours, weekends, or modifications by unexpected accounts.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
This rule detects potentially unauthorized or suspicious Google Forms collaboration invitations delivered via email. It filters for emails that pass full sender authentication (SPF, DKIM, and DMARC) and originate from Google infrastructure, while containing a specific Google Forms editor invite URL pattern. The rule excludes internal organizational communications from the Google domain and identifies specific return-path domains commonly associated with automated Google Forms sharing notifications to highlight external or unexpected collaboration requests.
Detects phishing emails that impersonate Scotiabank using the 'From' display name, while originating from a non-scotiabank.com domain. The rule identifies emails that bypass SPF and DMARC checks and originate from GoDaddy-hosted email services, as indicated by the 'X-SECURESERVER-ACCT' header, suggesting the use of a compromised small-business account.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
Detects high-velocity queries to Graph API regarding transitiveRoleAssignments, a Tycoon 2FA post-compromise activity. This activity is indicative of reconnaissance for role assignments within Microsoft Graph, potentially by an adversary like Volt Typhoon (Tycoon 2FA).
This rule detects successful additions or updates to service principal credentials or application certificates/secrets within Azure AD. This activity can indicate persistence establishment by an attacker who has compromised an account with sufficient permissions to manipulate application identities.
Detects incoming emails originating from Google infrastructure (Gmail or Google Forms) where the sender's display name closely matches the recipient's local username part. This heuristic is commonly used to identify targeted spearphishing campaigns where attackers impersonate internal users or trusted entities via abuse of legitimate Google services.
This rule detects potentially malicious email messages masquerading as Google Forms collaboration invitations. It identifies emails originating from Google-related domains that contain URLs for Google Forms with invite parameters. The detection logic filters for messages passing SPF, DKIM, and DMARC authentication checks to highlight legitimate-looking emails that may be part of a social engineering campaign, and flags instances where the sender's display name matches the recipient's name as a high-risk indicator of impersonation.
Detects cloud searches for sensitive keywords (credential, secret, etc.) followed by access to matching files.
Detects successful OAuth application consent events where the requested permissions include sensitive scopes such as Mail, Files, or User profile access. This is a common indicator of OAuth application-based phishing or persistence attempts, often referred to as 'Illicit Consent Grant' attacks.
Detects when a single user initiates a high volume (5 or more) of external guest user invitations within a one-hour window. This behavior can be indicative of reconnaissance or attempts to establish persistence by an compromised account by inviting external identities into the tenant.
Detects Device Code Flow authentication originating from abused Railway.com infrastructure, widely abused by Kali365.
Detects suspicious OAuth application or service principal registration, or permission consent, performed by users who are not part of designated IT administrator groups. This rule flags high-privilege permission grants (e.g., Mail.Read, Directory.ReadWrite.All) or application consent events, which are common methods for establishing long-term persistence in cloud environments.
This rule monitors for two distinct suspicious activities: 1) Inbound emails where the sender display name matches a list of executive titles, commonly indicative of Business Email Compromise (BEC) or executive impersonation attacks; 2) The creation of cloud service accounts with names mimicking administrative or IT support roles, which may indicate an adversary establishing persistent, privileged access.
Detects suspicious app installations, custom app creation, and bot additions within Microsoft Teams. This rule flags activities such as sideloaded app installations (which bypass Teams store vetting and can be used for persistence), custom app creation outside of typical development teams (potentially indicating C2 bots or data exfiltration apps), and the addition of bots, especially when combined with suspicious keywords in the app name. These actions can be indicative of an adversary establishing persistence or gaining unauthorized access and control within the Teams environment.
Inbox Rule Notification Suppression
Cortex XDR
Detects the creation or modification of inbox rules designed to hide security and MFA notifications by deleting, marking as read, or moving them to hidden folders. This technique is commonly used post-compromise to suppress alerts about rogue device enrollment, sign-ins, or password changes, preventing the victim from discovering an account takeover. It is a frequent Business Email Compromise (BEC) and Account Takeover (ATO) persistence technique.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign leveraging compromised legitimate domains to bypass email authentication controls.
Page 121 of 179