Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects instances where a non-administrative user grants an OAuth application consent to access high-privilege Microsoft Graph scopes, such as 'Mail.Read', 'Directory.ReadWrite.All', or 'offline_access'. This pattern is frequently used in consent phishing attacks to maintain persistent access to sensitive cloud resources.
Detects inbound Microsoft Teams calls or chats originating from an external or federated tenant where the caller's display name mimics internal IT support or helpdesk personnel, a technique used in social engineering and vishing campaigns.
Detects high-velocity, multi-application sign-in activity within a short timeframe (<= 15 minutes) originating from suspicious Python-based user agents (requests library). This pattern is often indicative of automated script-based reconnaissance or unauthorized access attempts against Microsoft 365 services.
Detects a sequence of events where a user is targeted by an email bombing attack, subsequently receives an external or anonymous Microsoft Teams call, and finally launches a known remote access tool (e.g., AnyDesk, TeamViewer) on the same host within a one-hour window. This pattern is consistent with social engineering campaigns designed to trick users into providing remote access to their systems.
Detects a high volume of 'MailItemsAccessed' operations within a short 15-minute window performed by a specific application ID. This behavior is often indicative of automated, bulk exfiltration of emails from a Microsoft 365 environment, potentially by a compromised application or an attacker using a malicious OAuth application.
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
This rule detects illicit OAuth consent grant events where an application is granted high-risk delegated permissions. This behavior is indicative of consent phishing or 'ConsentFix' tradecraft, where attackers trick users into granting permissions to a malicious application, thereby enabling unauthorized access to mail and file data.
This rule detects illicit OAuth consent grant events where an application is granted high-risk delegated permissions. This behavior is indicative of consent phishing or 'ConsentFix' tradecraft, where attackers trick users into granting permissions to a malicious application, thereby enabling unauthorized access to mail and file data.
Detects emails that appear to have been injected or sent using the 'swaks' SMTP testing tool rather than a standard Mail User Agent (MUA). The rule identifies this activity by looking for the 'swaks' signature in the 'X-Mailer' header or by matching a specific 'Message-Id' pattern typical of swaks.
Detects sign-in events in Entra ID where the OAuth 2.0 device authorization grant (device code) flow is utilized. This flow is a common vector for phishing attacks designed to steal tokens by tricking users into authenticating on a secondary device, potentially bypassing MFA.
Detects spearphishing attempts targeting accounts payable departments that impersonate executives using keywords related to invoices or payments. The rule identifies potential AI-generated text patterns (such as structural formatting artifacts, approval thread markers, or comment-like structures) often found in machine-generated fraud content, combined with executive-sender impersonation and external email domains.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
This rule detects scenarios where a user account modifies Conditional Access (CA) policies (specifically targeting user or group inclusion/exclusion settings) within one hour of that same user account modifying authentication method policies. This pattern is potentially indicative of an adversary weakening security controls by adjusting authentication requirements and subsequently tampering with CA policies to maintain persistence or bypass MFA.
Detects Azure sign-in events claiming successful hardware-key or FIDO2 authentication where the authentication issuer is not part of a known-good allow-list. This behavior is indicative of a rogue MFA provider, such as the TrustSink attack, which issues forged tokens claiming MFA requirements were satisfied.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
Detects emails containing URLs to known GitHub repositories used as lures for fake coding challenges or job interviews. These lures are often associated with DPRK-aligned threat actors (e.g., Jade Sleet, TraderTraitor) targeting technical roles.
Detects Azure AD user sign-ins from multiple distinct IP addresses or countries within a 1-hour window. This is a common heuristic used to identify potentially compromised credentials or impossible travel scenarios, where a single user account authenticates from geographically distant or disparate network locations in an unrealistic timeframe.
Detects inbound .ics calendar invite attachments that contain URLs, originating from sender domains not previously seen within the organization over the last 90 days, and distributed to 10 or more recipients. This pattern is indicative of a mass-distributed phishing campaign using calendar invites as a lure.
Detects phishing emails containing suspicious URLs pointing to PaaS platforms (Azure Static Web Apps, Cloudflare, Firebase) that exhibit credential harvesting characteristics (branded keywords or base64 patterns). The rule correlates these emails with subsequent clicks and a successful M365 sign-in by the same user within 30 minutes of the click, indicating a probable successful credential compromise.
Detects inbound .ics calendar invite attachments that contain URLs, originating from sender domains not previously seen within the organization over the last 90 days, and distributed to 10 or more recipients. This pattern is indicative of a mass-distributed phishing campaign using calendar invites as a lure.
Page 30 of 150