Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects the reuse of session identifiers (SessionId, DeviceId, or RefreshTokenJti) across different device fingerprints (e.g., changes in User-Agent, OS, or Browser) within a short timeframe. This behavior is indicative of session hijacking or adversary-in-the-middle (AiTM) attacks, where stolen session tokens or cookies are replayed by an attacker from a different endpoint than the original user.
Detects known file hashes associated with SideCopy/ReverseRAT.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour).
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
This rule detects potentially malicious emails that impersonate Microsoft account security notifications or security advisories. It looks for emails with specific social engineering themes in the sender name, sender address, or subject line, accompanied by .zip attachments that contain suspicious file names related to cybersecurity warnings or OTP abuse, which are common lures for malware delivery.
Detects unauthorized modifications to the Entra ID authentication methods policy or suspicious application activity often associated with the staging of rogue External Authentication Methods (EAM). Adversaries may exploit these configuration changes to intercept or bypass multi-factor authentication (MFA) during user login processes.
Detects the modification or creation of Azure AD applications that include specific malicious redirect URIs associated with 'TrustSink' style attacks, which abuse external authentication callback mechanisms to intercept tokens and bypass MFA.
Detects modifications or additions to Conditional Access policies or External Authentication Methods in Azure AD/Entra ID. These changes could be indicative of an adversary attempting to bypass multi-factor authentication or establish persistence by weakening authentication controls.
This rule monitors inbound emails for sender domains or embedded URLs that contain strings related to popular AI service brands (e.g., ChatGPT, Gemini, Claude). It flags these occurrences when the domain does not match the official, legitimate domains for those services, indicating potential phishing or brand impersonation attempts.
This rule monitors inbound emails for sender domains or embedded URLs that contain strings related to popular AI service brands (e.g., ChatGPT, Gemini, Claude). It flags these occurrences when the domain does not match the official, legitimate domains for those services, indicating potential phishing or brand impersonation attempts.
Detects the granting of tenant-wide admin consent for 'openid' and 'profile' scopes to 'AllPrincipals' within an Azure environment. This activity is indicative of the final stage in a TrustSink or similar rogue External Authentication Method (EAM) attack, where an adversary configures an application to bypass user consent prompts for sensitive identity scopes.
This rule correlates email attachment delivery events with subsequent process creation events on the recipient's endpoint. It identifies scenarios where a known document reader or mail client (Outlook, Word, Excel, PowerPoint, Adobe Acrobat/Reader) spawns a suspicious child process (PowerShell, CMD, WScript, CScript, MSHTA, Rundll32, or Regsvr32) shortly after a file is delivered via email to the same user. This detects the immediate execution phase of a phishing attack.
Detects the creation or invitation of new users in Azure AD where integrated identity-verification platforms have flagged document authenticity, liveness, or face matching as anomalies. These flags are cross-referenced with suspicious account attributes such as geolocation mismatches, the use of VOIP phone numbers, or the usage of newly registered email domains, suggesting a potential fraudulent account creation attempt.
This rule detects potential phishing emails themed around financial documents or shared files that contain URLs associated with device-code authorization phishing lures, such as ARToken PhaaS, or links hosted on workers.dev platforms commonly used for such activities.
Page 34 of 179