Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,926
7,251
6,535
3,864
3,632
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Monitors Azure AuditLogs for application consent events that grant high-privilege Microsoft Graph API scopes, such as Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All. This activity is a common indicator of illicit consent grant phishing attacks, where adversaries trick users into granting permissions to a malicious OAuth application to gain persistent, unauthorized access to sensitive data without requiring direct user credentials or MFA.
Monitors Azure AuditLogs for application consent events that grant high-privilege Microsoft Graph API scopes, such as Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All. This activity is a common indicator of illicit consent grant phishing attacks, where adversaries trick users into granting permissions to a malicious OAuth application to gain persistent, unauthorized access to sensitive data without requiring direct user credentials or MFA.
This rule detects potentially malicious inbox rule creation or modification in Office 365 Exchange. It flags rules that contain keywords associated with financial fraud (e.g., invoice, wire, payment) and include actions that hide evidence (e.g., moving messages to junk or deleting them). It further correlates these actions with suspicious user login activity, such as logging in from a new IP address or country within an hour of the rule change, which is a common indicator of a Business Email Compromise (BEC) account takeover.
Detects anomalous authentication behavior consistent with Adversary-in-the-Middle (AiTM) phishing attacks, specifically where an MFA-authenticated session is accessed from multiple, disjoint geographic locations or IP addresses within a short timeframe, indicating the replay of stolen session tokens.
Detects anomalous sign-in behavior where the same Entra ID session or refresh token is reused from two geographically distant IP addresses within a short timeframe. This activity is correlated with a prior suspicious OAuth consent-grant or device-code authentication event on the same account, which is a common indicator of an 'EvilTokens' style session-token replay attack.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects a suspicious sequence of events where a user exhibits signs of account compromise—either through impossible travel patterns or the use of OAuth tokens on a new device—followed within one hour by the modification of mailbox settings, such as creating new inbox rules or modifying mailbox permissions, which is a common indicator of persistence and email exfiltration.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
Detects incoming email messages where the Reply-To header address domain differs from the Sender From address domain. This technique is commonly used in phishing attacks to redirect victim replies to an attacker-controlled mailbox while maintaining a spoofed appearance in the original sender field.
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
Detects a sequence of activity where a user receives a high volume of inbound emails (potential vishing or social engineering lures) within a short window, followed by the user executing Windows Remote Assistance or Quick Assist tools within the next 6 hours, which is highly indicative of remote access social engineering pre-cursors.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
This rule detects inbound email messages where the SPF check passes for a specific domain (osc-cdn.com) or uses specific infrastructure (Migadu), but the DMARC check fails due to misalignment between the envelope domain and the From header. This pattern is indicative of email spoofing or domain impersonation attempts where the attacker abuses misconfigured SPF/DMARC policies (p=none) to facilitate spearphishing.
Detects an authentication pattern characteristic of credential compromise, consisting of a burst of failed authentication attempts against an account within a short window, followed immediately by a successful sign-in from an anomalous or new device/location. This pattern is indicative of brute-force or credential spraying followed by successful validation and potential lateral movement.
Detects an authentication pattern characteristic of credential compromise, consisting of a burst of failed authentication attempts against an account within a short window, followed immediately by a successful sign-in from an anomalous or new device/location. This pattern is indicative of brute-force or credential spraying followed by successful validation and potential lateral movement.
Detects a multi-stage attack chain originating with a healthcare-themed phishing email (e.g., billing or patient coordination lures) that leads to a link click, followed by a subsequent suspicious user sign-in from a non-managed/non-compliant device for the same recipient. This correlates email threat data, URL click telemetry, and sign-in logs to identify potential credential harvesting.
Page 14 of 150