Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,921
7,246
6,535
3,864
3,627
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a percentage from old permissions to new permissions
Identifies when a Google Workspace user transfers the ownership of a file.
Identifies SAML provider configuration changes in Google Workspace. Security teams can monitor for changes to SAML provider configuration that may weaken the organization's security posture.
Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.
Alerts when a permission on the watchlist is applied to an Entra ID application.
Application creation is a legitimate activity but doesn't occur frequently. Alerts when a new application is created in Entra ID (formerly Azure AD).
Identifies when a domain is added to the list of trusted domains in Google Workspace. An adversary may attempt to manipulate sharing settings for trusted domains to gain unauthorized access to sensitive files and folders within an organization.
Identifies when a Google Workspace user account is moved between Organizational Units.
This rule detects the creation or modification of email forwarding or redirection rules within Microsoft 365 audit logs. It specifically looks for operations related to 'UpdateInboxRules', 'Set-Mailbox', 'New-InboxRule', and 'Set-InboxRule' that include parameters indicative of forwarding or redirecting emails, such as 'Forward', 'Recipients', 'ForwardingSmtpAddress', 'ForwardingAddress', 'ForwardAsAttachmentTo', 'ForwardTo', 'RedirectTo', and 'RedirectToRecipients'. This activity can be a sign of an attacker attempting to exfiltrate sensitive information from a compromised mailbox or maintain persistence.
This rule detects when a user performs an eDiscovery search or exports a PST file from such a search within Microsoft 365. PST files often contain sensitive information, including email body content, making this activity a potential indicator of data exfiltration or unauthorized access to sensitive communications.
Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.
Detects when Microsoft Cloud App Security reports activities performed by users whose accounts have been terminated in Azure AD, but are still active in other platforms like AWS or Salesforce. This is particularly relevant for accounts used to manage resources that might not be terminated when a user leaves the company.
Detects when Microsoft Cloud App Security reports an unusual volume of file deletions by a user, which could indicate malicious activity such as data destruction or ransomware.
Detects the addition of a new Federated Domain in Microsoft Exchange. This event can be indicative of credential abuse or the establishment of a backdoor via federated identities, potentially in the context of a Golden SAML attack.
Detects when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that are potentially infected with ransomware. This indicates a possible ransomware attack attempting to encrypt or exfiltrate data via cloud storage.
Detects when Microsoft Cloud App Security reports that users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are associated with malicious activities, such as Botnet Command and Control, and may indicate a compromised account.
Detects when Microsoft Cloud App Security reports user activity originating from an IP address identified as an anonymous proxy. This indicates potential attempts to obscure the true source of network connections, which could be used for malicious purposes such as bypassing security controls or maintaining anonymity during an attack.
Detects when Microsoft Cloud App Security reports an activity originating from a country that has not been recently or ever visited by any user within the organization. This indicates potential unauthorized access or anomalous user behavior from an unusual geographic location.
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365. This rule will apply to ExchangePowerShell usage and from the cloud.
Detects when the Microsoft 365 Security Compliance Center restricts a user from sending email because they exceeded service sending limits. This could indicate a compromised account being used for spamming or other malicious activities, or a legitimate user exceeding limits due to unusual activity.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
Page 149 of 150