Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects an administrative content rule that combines strategic research or defence collection terms with an external BCC, forward, or redirect destination. GTIG reported that the Patroit rule matched subjects related to medical research, Chikungunya, artificial intelligence, cyber programmes, Indo-Pacific operations, defence, and uncrewed systems before silently forwarding the messages.
Detects hard deletion of mailbox data to remove forensic email evidence
Detects deletion of MFA configurations to enable authentication bypass
Detects OAuth application registration or permission grant via Graph API
Detects Microsoft Teams spawning child processes (cmd, powershell, wscript, mshta, rundll32, regsvr32, certutil) after receiving external communications, a technique used by MuddyWater for initial access and execution.
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects inbound emails that are fully authenticated (SPF, DKIM, DMARC pass) and contain keywords related to 'code of conduct', 'employee handbook', 'policy acknowledgement', or 'compliance update' in the subject line, originating from a sender domain that has not been observed by the recipient organization within the last 24 hours. This rule aims to identify potential phishing attempts leveraging social engineering themes from newly registered or previously unseen domains.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Detects sign-ins to M365 using the default Node.js user agent, indicative of the Tycoon 2FA kit relay tier.
This rule processes Microsoft Graph Security Alerts, aggregating evidence from various Microsoft Defender products (MDE, MDI, MDCA, MDO, Entra ID Protection). It extracts and normalizes detailed evidence related to devices, users, IP addresses, processes, files, URLs, emails, mailboxes, network connections, and Azure resources, providing a comprehensive view of security incidents across the Microsoft ecosystem.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
Identifies emails where the sender claims to be internal, but the X-MS-Exchange-Organization-AuthAs header is not set to 'Internal', indicating a potential Ghost-Sender exploit. This rule focuses on delivered emails to reduce noise and filters out expected external mail gateways and trusted automated senders.
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged and non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects inbound emails containing Google Forms links with the '/edit?invite=' parameter. This parameter grants editor privileges and is frequently abused in data harvesting campaigns to bypass traditional email gateway URL filtering.
Page 125 of 179