Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects high-privileged Entra ID accounts successfully reaching the verification stage of the Self-Service Password Reset (SSPR) process. While SSPR is automatically enabled for administrative accounts, this activity is anomalous and potentially indicates an attacker focusing on discovered privileged accounts after performing broader enumeration.
Detects anomalous, high-volume account enumeration against the Microsoft Self-Service Password Reset (SSPR) endpoint from a single source IP. The rule identifies a pattern of mixed response codes, specifically interleaving '50034' (Account does not exist) with successful or other outcomes, which indicates the use of automated tools to validate the existence of corporate accounts via response differentiation.
Detects anomalous, high-volume account enumeration against the Microsoft Self-Service Password Reset (SSPR) endpoint from a single source IP. The rule identifies a pattern of mixed response codes, specifically interleaving '50034' (Account does not exist) with successful or other outcomes, which indicates the use of automated tools to validate the existence of corporate accounts via response differentiation.
This rule detects potential AI agent prompt injection by monitoring email subjects or attachment names for keywords often associated with system instruction overrides. It correlates these potentially malicious emails with subsequent execution of common administrative or script-interpreting binaries (e.g., PowerShell, cmd.exe) on the recipient's device within a one-hour window, suggesting a potential successful hijack of an automated process or AI agent.
Detects high-volume file access or download operations in SharePoint or OneDrive performed by common scripting libraries and client user agents, which may indicate automated data exfiltration.
This rule detects a correlation between a successful user login from an IP address not previously seen for that specific user in the last 14 days, followed immediately (within 1 hour) by sensitive administrative operations performed by the same user, such as adding members to roles or modifying application permissions.
Detects successful authentication attempts in Azure AD or Microsoft 365 logs originating from known proxy/VPN service providers or identified by suspicious Python-requests user agent strings. The rule specifically filters for events where MFA was not satisfied, indicating potentially bypassed or failed security controls from potentially malicious infrastructure.
Detects incoming phishing emails that contain both a shortened URL and references to a password-protected RAR archive, often used to deliver malware while bypassing email security content inspection.
This rule detects potential social engineering attacks where an attacker initiates a Microsoft Teams call from an external domain while impersonating an internal IT support or help desk entity. The detection specifically correlates this event with a recent preceding email bombing campaign (exceeding 20 emails) targeting the same user within the last 3 hours, indicating a coordinated attempt to pressure or confuse the victim.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
Detects the creation of an application or service principal followed quickly (within 1 hour) by a tenant-wide delegated permission grant scoped to 'AllPrincipals' with 'openid' and 'profile' permissions. This sequence is a known indicator of automated rogue Enterprise Application setup, often used in consent phishing or persistence campaigns.
Detects user sign-ins that utilize an 'External Authentication Method' within 3 days of a password reset event. This behavior may indicate an adversary has successfully established persistence using a rogue authentication provider (e.g., via a TrustSink or similar malicious configuration) that survives password remediation and is capable of capturing or intercepting subsequent authentication tokens.
Detects incoming spearphishing emails that contain a ZIP archive attachment. The rule alerts if the archive contains an LNK file with a double extension (e.g., .pdf.lnk) or if the email subject contains specific social engineering lures related to food pricing or peace negotiations.
Detects Azure AD sign-in events where Multi-Factor Authentication (MFA) was reportedly satisfied by an External Authentication Method (EAM) claim without evidence of a traditional secondary authentication challenge. This behavior is indicative of a 'TrustSink' technique where a rogue or compromised OIDC provider injects a spoofed assertion of MFA success into the authentication token.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by identifying a pattern where a successful multi-factor authentication sign-in event is quickly followed by another successful sign-in for the same user from a different IP address, device, or geographic location. This behavior is indicative of session cookie theft and replay, commonly associated with phishing toolkits like Evilginx or NovaCookies.
This rule detects a multi-stage phishing campaign where an attacker uses legitimate Notion infrastructure to host PDF invitation lures. The detection correlates email delivery of a Notion-themed invitation with a subsequent user click on a URL containing device code authorization keywords (such as 'device', 'devicelogin', or 'code') within a 60-minute window, which is indicative of a device-code harvesting attack.
Detects potential Adversary-in-the-Middle (AiTM) session token replay attacks where a user successfully authenticates with MFA and is followed shortly by a subsequent successful login for the same user from a different IP address or device without a fresh MFA challenge, suggesting the use of a stolen session cookie.
This rule detects potential account hijacking via OAuth device-code authorization flow, specifically identifying patterns associated with phishing kits (e.g., EvilTokens, ARToken). It monitors sign-in events where the device code flow is utilized, specifically flagging successful grants that potentially bypass standard interactive credential prompts.
Page 32 of 150