Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects scenarios where an account experiences mail bombing activity followed closely by a suspicious Microsoft Teams chat initiation by an external user within a 2-hour window, potentially indicating a multi-stage social engineering or extortion campaign.
This rule monitors for network and user interaction with known phishing domains that impersonate Microsoft, Outlook, or Teams services. It aggregates data from DNS queries, device network connections, inbound email URL links, and web URL click events to identify potential phishing attempts using a community-sourced watchlist from phishunt.io.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts.
Another small hunting idea using CallActivityEvents Table. The query extracts the Top-Level Domain (TLD) from the person performing the action in a Microsoft Teams call and enriches it with an external country list. In this example, I exclude .CH to quickly surface activity where the originator is using a domain associated with another country. A different hunting angle to spot unexpected external participants, unusual call activity, or simply identify interactions that deserve a closer look. Of course, a foreign TLD is not malicious by itself — it is just another piece of context for the hunter. 🔎
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application.
This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks.
Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization.
If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures.
This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks.
Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization.
If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
Detects a single identity/IP querying Microsoft Graph endpoints for directory roles, role management, registered authentication methods, applications, service principals, OAuth2 permission grants, and app role assignments within a short window - control-plane reconnaissance mapping privilege escalation and persistence opportunities
Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption.
This rule detects a suspicious sequence of events where a user performs an unusual device-code authentication (potentially indicative of device code phishing) followed shortly by an OAuth application consent or permission grant event. It flags potential compromise if the sign-in is new for the user or occurs in a short timeframe, with optional indicators associated with the 'maillive.sbs' phishing infrastructure.
Detects high-risk operations performed by the Entra ID/AAD Connect synchronization service account (e.g., Sync_* or ADToAADSyncServiceAccount). This account, which often holds broad directory permissions, is a prime target for attackers to gain persistence or escalate privileges within the cloud directory. The rule monitors for unauthorized sign-ins, sensitive configuration changes (such as modifications to federation trust, authentication policies, or directory synchronization settings), and password resets targeting the sync account itself.
Detects emails from free-mail domains (@mail.com or @outlook.com) that contain a specific malicious infrastructure indicator in the InternetMessageId or originate from a known suspicious IP address associated with TA419-style spoofing campaigns. This indicates the email was relayed through unauthorized infrastructure rather than the expected legitimate mail providers.
Page 4 of 179