Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects internal spearphishing emails containing subjects and body text commonly associated with payroll fraud, specifically attempts to solicit changes to employee direct deposit accounts by requesting voided checks or information about upcoming payments.
Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.
Detects Microsoft 365 sign-in activity consistent with adversary-in-the-middle (AiTM) token theft. The rule identifies successful sign-ins with multi-factor authentication, immediately followed by a new session attempt for the same user within 30 minutes from a different device, IP address, or location.
Detects reconnaissance activity targeting sensitive personnel groups (payroll, HR, finance) via Microsoft Graph API. The rule identifies suspicious URI patterns combined with the use of the 'axios' User-Agent library, potentially indicating automated enumeration by an adversary to map high-value targets for future business email compromise or credential theft.
This rule detects high-confidence phishing emails that were delivered to either the Inbox or Junk folder. It explicitly filters out messages that have been explicitly allowed by organization-level policies, user-level actions, or specific safe-sender bypass mechanisms, ensuring the alert focuses on malicious emails that bypassed standard security filters without an authorized exception.
This rule detects high-confidence phishing emails that were delivered to either the Inbox or Junk folder. It explicitly filters out messages that have been explicitly allowed by organization-level policies, user-level actions, or specific safe-sender bypass mechanisms, ensuring the alert focuses on malicious emails that bypassed standard security filters without an authorized exception.
Detects a suspected EvilTokens attack sequence where a user clicks a phishing URL and subsequently initiates a browser session to the Microsoft device-code authorization page (devicelogin) within 15 minutes, with the phishing lure domain appearing in the browser context.
Detects a suspected EvilTokens attack sequence where a user clicks a phishing URL and subsequently initiates a browser session to the Microsoft device-code authorization page (devicelogin) within 15 minutes, with the phishing lure domain appearing in the browser context.
Detects a suspected EvilTokens attack sequence where a user clicks a phishing URL and subsequently initiates a browser session to the Microsoft device-code authorization page (devicelogin) within 15 minutes, with the phishing lure domain appearing in the browser context.
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
This rule detects incoming email messages containing .zip attachments with filenames that mimic financial documents (e.g., NFe, DANFE, invoice-related keywords) combined with numerical strings. This naming pattern is commonly associated with phishing campaigns attempting to deliver malicious archives.
This rule detects a correlation between a successful user login from an IP address not previously seen for that specific user in the last 14 days, followed immediately (within 1 hour) by sensitive administrative operations performed by the same user, such as adding members to roles or modifying application permissions.
Detects the creation of an application registered with a specific Microsoft external authentication provider URI, immediately followed by the configuration of its service principal with reply URLs pointing to external tunneling services like ngrok. This sequence is indicative of an attacker attempting to register a rogue MFA provider to intercept authentication requests.
This rule detects inbound emails where the sender domain matches the recipient domain (internal-looking), but the message authentication (SPF/DKIM/DMARC as indicated by CompAuth status) failed or was not performed. This is indicative of abuse of Exchange Online 'Direct Send' or similar unauthenticated relay methods to spoof internal identities.
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication methods policy where a new external authentication method is configured using a non-approved discovery URL. This could indicate an adversary attempting to configure a malicious identity provider to facilitate authentication bypass or unauthorized access.
Detects a sequence of activity where a user receives a high volume of inbound emails (potential vishing or social engineering lures) within a short window, followed by the user executing Windows Remote Assistance or Quick Assist tools within the next 6 hours, which is highly indicative of remote access social engineering pre-cursors.
Flags anomalous volume of Entra ID sign-ins using the device-code authorization grant, matching the Kali365 phishing-as-a-service technique (sold on Telegram, ~$250/month per FBI PSA) that captures Microsoft 365 OAuth tokens through the legitimate device-code flow.
Flags installation of RMM tools (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop) on an endpoint shortly after that user's account undergoes a password/MFA reset — matches the post-vishing tooling pattern CrowdStrike attributes to Mutant Spider (loaders including PrionFlaire and SocksLoader) and Scattered Spider.
Flags changes to a user's registered SMS/voice MFA phone number followed by a successful high-risk sign-in — the SIM-swap/SMS-interception bypass step documented across the 2024-2026 vishing threat-report taxonomy (CrowdStrike, Mandiant, Pindrop).
Page 29 of 150