Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour).
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
This rule detects potentially malicious emails that impersonate Microsoft account security notifications or security advisories. It looks for emails with specific social engineering themes in the sender name, sender address, or subject line, accompanied by .zip attachments that contain suspicious file names related to cybersecurity warnings or OTP abuse, which are common lures for malware delivery.
This rule monitors inbound emails for sender domains or embedded URLs that contain strings related to popular AI service brands (e.g., ChatGPT, Gemini, Claude). It flags these occurrences when the domain does not match the official, legitimate domains for those services, indicating potential phishing or brand impersonation attempts.
This rule monitors inbound emails for sender domains or embedded URLs that contain strings related to popular AI service brands (e.g., ChatGPT, Gemini, Claude). It flags these occurrences when the domain does not match the official, legitimate domains for those services, indicating potential phishing or brand impersonation attempts.
Detects the granting of tenant-wide admin consent for 'openid' and 'profile' scopes to 'AllPrincipals' within an Azure environment. This activity is indicative of the final stage in a TrustSink or similar rogue External Authentication Method (EAM) attack, where an adversary configures an application to bypass user consent prompts for sensitive identity scopes.
Detects successful sign-in events where Multi-Factor Authentication (MFA) was satisfied using an 'External Authentication Method' that reports specific claim identifiers ('possessionorinherence' or 'hwk'). This pattern is indicative of the TrustSink rogue-EAM (External Authentication Method) technique, where an attacker exploits custom MFA providers to forge MFA success assertions, effectively bypassing legitimate hardware-key requirements.
This rule detects potential phishing emails themed around financial documents or shared files that contain URLs associated with device-code authorization phishing lures, such as ARToken PhaaS, or links hosted on workers.dev platforms commonly used for such activities.
Detects potential theft and reuse of session or refresh tokens for Microsoft 365 services (Exchange/SharePoint) by identifying multiple authentication events for the same user account from different geographic locations and IP addresses within a short timeframe, specifically when no new MFA challenge was performed.
Detects potential abuse of the Microsoft Graph API by correlating device-code authentication events with subsequent high-volume activity, such as mail or file enumeration, from the same account within a short window. This pattern is indicative of ARToken-style token proxying, where an attacker intercepts an OAuth device-code token to gain unauthorized access to an user's resources.
Detects potential persistence establishment in M365 environments following anomalous or risky sign-in events. This pattern is characteristic of Adversary-in-the-Middle (AiTM) attacks where a session cookie is stolen, followed by immediate adversary actions to secure long-term access, such as MFA method registration, OAuth app consent, or mailbox rule configuration.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects Azure AD/Entra ID sign-ins performed using the OAuth device-code flow, excluding common administrative tools like the Azure CLI or PowerShell. This flow is frequently abused in phishing campaigns (such as EvilTokens or ARToken) where attackers entice victims to enter a device code into a malicious application, allowing the attacker to gain authorized access to the victim's session.
Detects potential account compromise by identifying a specific sequence of behavior: reconnaissance of sensitive users (HR/Payroll) via Microsoft Graph API calls, followed by the creation of inbox rules (e.g., forwarding) by the same user account within a 12-hour window.
Detects anomalous, automated non-interactive sign-in activity in Microsoft 365 where a session token is replayed from a new source IP address approximately every 8 hours. This pattern is characteristic of automated token-refresh tooling, such as that associated with Storm-2755, utilizing specific user-agents (Firefox 131.0/151.0 or python-requests) that deviate from the user's typical browser fingerprint.
Detects the creation of inbox rules (e.g., move, delete, stop processing) on M365 accounts, followed by the transmission of emails with subjects related to 'direct deposit'. This pattern is frequently observed in Business Email Compromise (BEC) campaigns where attackers automate the concealment or exfiltration of sensitive payroll-related communications.
Detects non-interactive sign-in events to M365 that claim to be from the Outlook client application but utilize suspicious or unexpected User-Agent strings (e.g., Python requests, specific Firefox versions). This behavior is often indicative of programmatic access or automated tools used by attackers to harvest credentials or interact with mailboxes, bypassing standard browser-based authentication controls.
Page 28 of 150