Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects emails containing URLs with patterns characteristic of the Tycoon 2FA phishing kit. These URLs often contain a base64-encoded email address in the path, preceded by a special character.
This rule identifies emails sent from an internal employee email address to external personal email domains where the recipient's local part of the email address contains tokens from the sender's display name for more than 0 words matching. It also analyses attachments for sensitive keywords (e.g., 'confidential', 'secret') and assigns a risk score based on factors like email volume, attachment count, and presence of sensitive attachments. This could indicate an attempt to exfiltrate sensitive company data to a personal account.
It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
Query sign-ins with MFA success immediately following multiple failed sign-ins from different regions. Potential session hijack or AiTM (Adversary-in-the-Middle).
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
This rule detects emails or URL click events containing a specific pattern associated with 'quantum.php' within the URL. This pattern is often indicative of phishing attempts, particularly those designed to harvest credentials or deliver malware.
* Compare distances and times of consecutive sign-ins for the same user.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
This detection looks for administrative activity that creates or updates Cross-Tenant Access Settings or Cross-Tenant Identity Synchronization Settings in Microsoft Entra ID (Azure AD). These settings control how identities, claims, and trust relationships are shared between Microsoft Entra tenants.
To detect sensitive or confidential information sent by email from our users, I discovered that DefenderXDR is registering events when some user or services is reading files tagged or marked as sensitive. Basically, it has a "SensitiveFileRead" ActionType in the DeviceFileEvents table which indicates that a process on the monitored device has accessed a file classified as sensitive. This could include files with personally identifiable information (PII), intellectual property, or other data deemed sensitive based on the organization’s data protection policies or Microsoft’s predefined rules. This event type is essential for tracking access to sensitive data, helping to identify potential data leakage or unauthorized access attempts.
This rule detects when an MDI (Microsoft Defender for Identity) sensor is deleted. This could indicate an adversary attempting to impair defenses by removing security monitoring tools.
This rule detects when an MDE offboarding package is downloaded.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
This hunting query verifies the availability and health of critical Microsoft 365, Azure, and Defender data sources that are essential for visibility in the case of incident response.
Ensuring these log sources are active is fundamental for maintaining readiness to conduct full-scope investigations when an incident occurs without data loss or visibility gaps.
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Ensuring these log sources are active is fundamental for maintaining readiness to conduct full-scope investigations when an incident occurs without data loss or visibility gaps.
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
Detects inbound emails with a Virtual Hard Disk (VHDX) file attachment. This technique has been used by APT-C-60 to deliver the SpyGlace backdoor, often disguised as a job application.
Detects a single Gmail sender address using multiple distinct display names within a short timeframe (1 hour). This behavior can indicate an attempt at impersonation, phishing, or spam campaigns where an attacker tries to appear as different entities from the same compromised or controlled email account.
Detects access or search activity in SharePoint or OneDrive involving keywords related to gift cards, IT workflows, and remote access. This is a reconnaissance technique used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) to find sensitive internal documentation.
Detects URLs that use the `https://user@host` syntax where the 'user' part is crafted to look like a legitimate domain (e.g., `https://example.com@malicious-site.net`). This is a technique used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) to craft convincing phishing links.
In Microsoft 365 environments, administrators and certain privileged users can access mailbox content through actions such as email preview or message download. While these capabilities are often used for legitimate purposes — such as security investigations, eDiscovery, or incident response — they also represent a potential insider threat or privacy violation risk if misused.
Unauthorized access to mailbox data can expose confidential communications, sensitive attachments, or personally identifiable information (PII). Therefore, it’s crucial to continuously monitor when administrators perform actions like:
GetMailPreviewUrl – viewing an email’s content through a preview link
DownloadEMail – exporting or downloading a full email message
If these actions are not tied to a legitimate investigation or security workflow, they could indicate abuse of administrative privileges or data exfiltration attempts.
Unauthorized access to mailbox data can expose confidential communications, sensitive attachments, or personally identifiable information (PII). Therefore, it’s crucial to continuously monitor when administrators perform actions like:
GetMailPreviewUrl – viewing an email’s content through a preview link
DownloadEMail – exporting or downloading a full email message
If these actions are not tied to a legitimate investigation or security workflow, they could indicate abuse of administrative privileges or data exfiltration attempts.
Detects a high volume of emails being moved to the 'Deleted Items' folder from the 'Inbox' or 'Sent Items' folders by a single user in a short timeframe. This behavior is a known tactic used by threat actors, such as the 'Jingle Thief' group (CL-CRI-1032/Atlas Lion), to hide malicious activities like internal phishing by deleting the sent messages and any replies.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
KQL Query from file: Detecting Threat Actor Storm-2657
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith. The rule specifically looks for 'UserLoggedIn' operations with 'Success' status for the Microsoft Intune Company Portal ApplicationId, while excluding a specific ObjectId often associated with mobile device enrollment to reduce false positives.
Page 141 of 179