Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects instances where a user grants consent to an unverified OAuth application with high-privilege scopes (e.g., Mail.Read, Directory.Read.All), followed by an authentication event using that same application ID from a different IP address within 24 hours. This behavior is indicative of potential consent phishing or OAuth token abuse, where an adversary harvests tokens to maintain persistent, remote access to email or directory services.
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Detects anomalous device-authorization-grant (RFC 8628) activity indicative of device-code phishing attacks (e.g., Tycoon2FA). The rule identifies user accounts exhibiting a rapid succession of 'authorization_pending' (70016) status polling attempts followed by a successful token issuance (0), constrained to a short time window and excluding known first-party Microsoft CLI/dev-tool applications.
Detects anomalous device-authorization-grant (RFC 8628) activity indicative of device-code phishing attacks (e.g., Tycoon2FA). The rule identifies user accounts exhibiting a rapid succession of 'authorization_pending' (70016) status polling attempts followed by a successful token issuance (0), constrained to a short time window and excluding known first-party Microsoft CLI/dev-tool applications.
Detects anomalous device-authorization-grant (RFC 8628) activity indicative of device-code phishing attacks (e.g., Tycoon2FA). The rule identifies user accounts exhibiting a rapid succession of 'authorization_pending' (70016) status polling attempts followed by a successful token issuance (0), constrained to a short time window and excluding known first-party Microsoft CLI/dev-tool applications.
Detects a suspicious sequence of events where a user exhibits signs of account compromise—either through impossible travel patterns or the use of OAuth tokens on a new device—followed within one hour by the modification of mailbox settings, such as creating new inbox rules or modifying mailbox permissions, which is a common indicator of persistence and email exfiltration.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
Detects a suspected device-code phishing attack where a user visits a known malicious lure domain and shortly thereafter completes a successful Microsoft 365 device-code authentication. This rule correlates network events with sign-in logs within a 10-minute window to identify session hijacking attempts that bypass traditional MFA.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects accounts showing a spike in requests to public generative-AI services compared to their historical baseline, combined with anomalous indicators like multiple source IPs, regions, or off-hours activity.
Detects instances where a single user account exhibits an anomalously high frequency of requests to public generative-AI platforms within a one-hour window, potentially indicating automated reconnaissance or data staging activities using AI tools.
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects high-volume, rapid enumeration of core Microsoft Graph directory endpoints (users, groups, applications, and servicePrincipals) by a single identity or session. This behavior is indicative of reconnaissance tools such as AADInternals, ROADtools, or TokenTactic being used to map out a cloud environment's directory structure.
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects the 'auto-exfil' pattern associated with the TeamFiltration tool. The rule identifies a sequence of SharePoint Online file access immediately followed by a Microsoft Graph token request from the SharePoint Online Web Client Extensibility app. To reduce noise, it mandates a very short time delta between events (<= 60 seconds) combined with either the use of an IP address/ASN not previously seen for the account in the last 14 days, or a preceding failed sign-in attempt for the account.
Page 28 of 179