Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Correlates browsers encountering a certificate error (invalid issuer) for a major cloud provider due to DNS redirection.
Detects a new mailbox rule that deletes, moves, redirects, or marks as read messages containing security, sign-in, MFA, alert, or administrator terms. This behavior is often indicative of an adversary attempting to hide their activities or prevent detection by preventing security notifications from reaching the user.
Detects the creation or modification of inbox rules that automatically mark emails as read and move them to a folder. This behavior is commonly used by adversaries to hide phishing replies or other malicious email activity from the victim's primary inbox.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
Identifies Python-based automated Graph API queries searching the directory based on name patterns and role attributes. This rule correlates sign-in logs with Microsoft Graph CloudAppEvents to detect suspicious activity originating from Python scripts interacting with the Microsoft Graph API.
Detects specific URI patterns used by Storm-2949 to enumerate users, indicating automated directory reconnaissance. The rule specifically looks for Microsoft Graph API calls that include both '$select=displayName,userPrincipalName,jobTitle' and '$top=50' in the RawEventData, which are indicators of user enumeration.
Detects the creation of a new deviceManagementScript or deviceShellScript object in Intune, indicating a PowerShell (Windows) or Shell (macOS/Linux) script has been uploaded to the Intune management platform. This is considered a high-fidelity indicator of script-based abuse as these scripts execute as SYSTEM on targeted endpoints and leave minimal forensic traces. The rule also identifies script creation initiated by service principals that might bypass human-UPN-based monitoring.
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
Detects internal spearphishing emails used to spread within an organization
Detects registration of potentially malicious OAuth applications in Azure AD
This rule identifies rapid, multi-category reconnaissance activity against the Microsoft Graph API. It specifically looks for bursts of 20 or more requests across 4 or more unique Graph API endpoints within a one-minute window, particularly when those requests include parameters like '$top=999', '$count=true', or target '/beta/' endpoints, which are indicative of attempts to extract maximum data or use less common API versions. This behavior is typified by threat actors like Tycoon 2FA operators.
This rule detects suspicious administrative activities in Azure AD, Microsoft Graph, SharePoint, Exchange, or Teams when performed by accounts that are not explicitly identified as 'admin' or 'service' accounts. It looks for a combination of at least 5 operations and 2 unique operation types within a 2-hour window, targeting group, application, or service principal related resources. This could indicate an attacker using compromised non-privileged accounts to perform administrative actions or escalate privileges.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
Detects OAuth application registration or permission grant via Graph API
Detects bulk Azure AD user account enumeration via Graph API
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
Identifies outbound network connections to the Microsoft Device Code authentication endpoint, which may indicate phishing attempts (e.g., via PhaaS kits like Kali365).
This rule detects potential data exfiltration attempts or sensitive information disclosure through Microsoft Copilot Enterprise Search. It specifically looks for 'URLClick' actions from 'Microsoft Copilot Enterprise Search' where the raw event data contains a 'q=' parameter (indicating a query) and also contains keywords like 'extract', 'embed', or 'img'. This combination suggests that a user might be attempting to extract or embed content, potentially sensitive, via a Copilot search query, which could lead to data leakage.
Detects a sender transmitting many attachment-bearing messages or a large aggregate attachment volume to external recipients within thirty minutes. This could indicate data exfiltration or a compromised account being used to send spam or malware.
Detects Graph API or SharePoint activity interacting with specific lists or a site GUID used by the jupyter-powerdev backdoor for Command and Control (C2) operations. This activity is indicative of the jupyter-powerdev malware leveraging SharePoint as a C2 channel.
Detects post-compromise inbox rule creation that moves security/phishing alerts to a folder and marks them as read. This behavior is often associated with adversaries attempting to hide their activities or prevent detection.
Page 124 of 179