Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects potential SaaS supply-chain attacks where a third-party application or connector triggers an OAuth permission scope escalation or publishes a new version, followed by the associated service account initiating outbound network connections to rare or newly-registered domains within a 24-hour window.
This rule detects potential social engineering attacks where an external or federated user impersonates an IT or helpdesk entity within Microsoft Teams (via chats, messages, or calls) followed shortly by an MFA registration or password reset event for the targeted user. This sequence is indicative of a vishing or phishing attack aimed at account takeover.
Detects the granting of high-privilege permissions (e.g., mail.read, files.readwrite) to a newly registered OAuth application (less than 24 hours old), followed by high-volume API activity from that same application within one hour. This behavior is indicative of an illicit OAuth consent grant attack, where an adversary lures a user into granting permissions to a malicious application to maintain persistent access to cloud resources or perform data exfiltration.
Detects incoming spearphishing emails that contain a ZIP archive attachment. The rule alerts if the archive contains an LNK file with a double extension (e.g., .pdf.lnk) or if the email subject contains specific social engineering lures related to food pricing or peace negotiations.
Detects when a user account assigned to high-privileged roles (Global Administrator or Authentication Policy Administrator) performs sensitive operations such as application registration, service principal creation, or modifications to authentication policies within a short timeframe (4 hours) of a successful sign-in. This activity is often associated with the initial setup phases of MFA bypass or persistence techniques in Entra ID.
Detects potential vishing or account takeover precursor activity where an external or guest Microsoft Teams user, impersonating IT or Help Desk support, communicates with a user who subsequently modifies their credentials or MFA configuration within the same 24-hour period.
Detects phishing emails that utilize document-themed subjects (e.g., invoices, shared documents) containing Windows Internet Shortcut (.url) attachments that redirect users to Cloudflare Workers-based 'docviewer' pages, often linked in conjunction with suspicious SharePoint file shares.
Detects phishing emails that use common voicemail notification subject lines combined with Mailchimp click-tracking or redirect infrastructure. This combination is often used to bypass traditional email gateway filters by utilizing legitimate marketing service domains to obfuscate final malicious destinations.
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
Detects a specific phishing pattern where a legitimate, authenticated DocuSign notification is followed by a user clicking a link within that document that redirects to known malicious infrastructure or OAuth-abuse sites (e.g., .vu domains, credential harvesting proxies). This heuristic identifies the link as being embedded in the shared document rather than the email body.
This rule detects a multi-stage phishing attack sequence: it correlates the receipt of an invoice-themed email containing an anonymous SharePoint link with the subsequent local creation of a Windows Internet Shortcut (.url) file, followed by a Microsoft OAuth device-code authentication sign-in attempt by the user within a short timeframe. This behavior is indicative of an adversary tricking a user into downloading a malicious shortcut that facilitates OAuth device code phishing.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
This rule monitors email traffic to detect scenarios where a single recipient is receiving a large volume of emails (at least 30 messages) from a high number of unique senders (at least 15) within a one-hour window. This behavior is indicative of a potential bulk spam or phishing campaign targeting a specific mailbox, which may be attempting to overwhelm the recipient or bypass traditional filters through volume.
This rule detects potential MFA phishing attempts by identifying access to known malicious domains used for MFA credential harvesting within email communications and network traffic. It flags instances where users interact with domains masquerading as legitimate multi-factor authentication setup or registration services.
Detects anomalous, high-volume activity in cloud-based services such as SharePoint, OneDrive, and Exchange, specifically tracking file access, downloads, and mailbox exports. This behavior may indicate bulk data collection, unauthorized exfiltration, or malicious data staging by a compromised account.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
Detects Microsoft Graph API requests targeting user information endpoints (/v1.0/users or /v1.0/me) using specific search filters associated with payroll or human resources and identified by the Axios HTTP client User-Agent string. This pattern is consistent with reconnaissance activities.
Detects specific, targeted search operations within M365 environments for keywords related to payroll, HR, and banking information. This behavior is indicative of post-compromise reconnaissance activity, often following AiTM (Adversary-in-the-Middle) session hijacking where an attacker attempts to locate financial documents and payroll correspondence.
Detects the creation or modification of inbox rules in Microsoft 365 that filter messages containing financial keywords (e.g., 'direct deposit', 'bank') and perform actions designed to hide or suppress these emails (e.g., 'MoveToFolder', 'DeleteMessage', 'MarkAsRead', 'StopProcessingRules'). This behavior is commonly used by adversaries to hide notification emails regarding financial transactions, which could alert the user to unauthorized activity.
Detects M365 administrative actions related to mailbox forwarding rules or OAuth application consent that occur in the absence of a Multi-Factor Authentication (MFA) claim, particularly when preceded by non-interactive session events (LogonType 0) using REST client protocols. This pattern is indicative of potential session hijacking or token replay attacks, where an adversary leverages a compromised session to establish persistence or gain ongoing access to the environment without re-authenticating.
Page 25 of 150