Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,921
7,246
6,535
3,864
3,627
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects high-volume Microsoft Graph API activity using attacker-associated user agents, such as python-requests, curl, or httpx, which may indicate automated token sweeping or data collection associated with supply-chain attacks.
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Detects inbound emails impersonating OpenCode breach notices that urge API key rotation and contain links to non-OpenCode domains.
Detects a potential social engineering or phishing attack pattern where a recipient first receives a high volume of inbound emails (mail flood) within a short window, followed quickly by an external Microsoft Teams chat message from an IT-themed sender attempting to impersonate internal support.
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.
Detects incoming xAI invitation emails from noreply@x.ai containing URLs that do not belong to the x.ai domain, which may indicate a phishing attempt or link injection.
Correlates a device code flow sign-in event with bulk file downloads from SharePoint or OneDrive by the same user account within a 1-hour window. This behavior can indicate potential account compromise or misuse where an adversary uses device code phishing to authenticate and subsequently exfiltrate sensitive files.
Detects delivered emails where the subject line matches a specific pattern (five digits followed by a hyphen and text) and the attachment filename corresponds to the extracted subject text, ending with 'Document.xlsx', and the email was not quarantined post-delivery.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Users who received a delivered phishing email and then signed in from an IP not seen for them in the prior 30 days within 24 hours. Hunting query, not an alert.
Detects service principal sign-ins involving known compromised application IDs associated with the ConnectWise cloud backup and management supply-chain attack.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
M365 Malicious Mailbox Rule Abuse
Cortex XDR
Detects the creation or modification of Microsoft 365 Exchange inbox rules that exhibit characteristics of malicious behavior, such as using trivial or blank names, moving items to rarely-monitored folders (e.g., 'Conversation History', 'RSS Feeds'), or containing keywords related to phishing, credential harvesting, or financial fraud.
Detects incoming xAI invitation emails from noreply@x.ai containing URLs that do not belong to the x.ai domain, which may indicate a phishing attempt or link injection.
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Page 2 of 150