Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule flags FIFA-related phishing emails from senders your organisation has never received mail from before. New senders plus urgent sports language is a common fraud pattern. Use multi-factor authentication on mail-linked accounts. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects incoming emails containing hyperlinks to legitimate Microsoft device code authentication pages combined with keywords or spoofed branding for document sharing services like DocuSign, Adobe Acrobat Sign, or SharePoint. This technique is indicative of Kali365 and similar Phishing-as-a-Service (PhaaS) kits attempting to steal OAuth tokens and bypass MFA.
This rule detects the issuance of OAuth tokens or OAuth consent events within cloud applications. It specifically looks for these events where the client application is not 'Microsoft Teams' or 'Azure CLI'. The rule summarizes the number of grants and distinct users for each client application and token ID over hourly intervals. This can help identify potentially unauthorized or suspicious OAuth application consents.
This rule detects emails containing multiple obfuscated URLs from common URL shortening services (bit.ly, tinyurl, short.link) originating from external senders. It specifically looks for emails with 3 or more such URLs within a one-hour window from the same sender.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
Detects inbound email that fails SPF authentication indicating email spoofing
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Detects bulk harvesting of Teams messages for credentials or sensitive data
Detects assignments of Intune objects (such as policies, scripts, or applications) to high-impact default groups like 'All Devices' or 'All Users'. Adversaries leverage these broad assignments to maximize the blast radius of malicious payloads or destructive wipe commands.
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
This rule detects potential phishing attempts involving malicious file sharing via OneDrive. It specifically looks for HTTP traffic directed to 'onedrive.live.com' with 'sharing' in the URI. A threshold is set to trigger an alert if five such events occur from the same source within 60 seconds, indicating a potential automated or repeated attempt to share malicious content.
This rule detects suspicious activity where a user successfully performs a multi-factor authentication (MFA) device login to Microsoft Office 365 via a browser, and within a 15-minute window, the same user either creates a new inbox rule or adds a new device. This combination of events could indicate an adversary gaining initial access and then setting up persistence (e.g., forwarding emails) or further device enrollment.
This rule detects potential internal phishing campaigns by identifying newly observed sender domains that send emails to a large number of internal recipients within a short period. It looks for sender domains that have been seen for the first time within the last 7 days, have sent emails to more than 10 unique recipients, and have sent more than 5 emails in total. This behavior can indicate an attacker attempting to phish internal users from a newly created or compromised domain.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
Detects creation of malicious inbox rules via Exchange Web Services for persistence
Page 127 of 179