Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects a sequence of suspicious activities associated with EvilTokens-style session hijacking. This includes the identification of non-interactive sign-in events involving the redemption of a refresh token without secondary MFA, followed by the creation or modification of Exchange Online mailbox rules to facilitate unauthorized email forwarding or exfiltration.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects high-volume, individually-tailored spear-phishing campaigns likely assisted by Generative AI. The rule monitors for a single sender targeting a high number of unique recipients with distinct, non-identical email subjects within a short timeframe. It specifically flags activity involving newly registered look-alike domains and interactions with credential-harvesting patterns in URLs.
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
This rule monitors for the creation or modification of inbox rules in Microsoft 365 that contain financial-related keywords (e.g., 'payment', 'wire', 'invoice') and disruptive actions such as deleting, moving, forwarding, or redirecting messages. These patterns are characteristic of Business Email Compromise (BEC) attacks, where adversaries attempt to conceal financial correspondence from the victim to facilitate fraudulent transactions.
This rule detects potentially malicious Microsoft Graph API activity, such as the enumeration of directory roles, groups, applications, or service principals. It identifies patterns indicative of token theft or unauthorized access by flagging scripted clients (non-browser agents) or accounts showing anomalous behavior (multiple IPs/agents) performing rapid or repetitive enumeration queries.
Detects instances where Microsoft 365 Copilot surfaces content labeled with sensitivity markings to a user who only has access to that content via inherited or broad sharing permissions (e.g., Company link, Anonymous link, or inherited permissions), rather than explicit access. This identifies potential AI-retrieval exploitation patterns where Copilot inadvertently exposes sensitive information due to oversharing configurations.
This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.
Detects the creation of email mailbox or transport rules that perform actions like hiding, deleting, marking as read, forwarding, or redirecting emails with finance or payment-related keywords. This behavior is indicative of a Business Email Compromise (BEC) post-exploitation workflow where adversaries attempt to conceal malicious activity or divert financial communications.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects high-privileged Entra ID accounts successfully reaching the verification stage of the Self-Service Password Reset (SSPR) process. While SSPR is automatically enabled for administrative accounts, this activity is anomalous and potentially indicates an attacker focusing on discovered privileged accounts after performing broader enumeration.
Detects anomalous, high-volume account enumeration against the Microsoft Self-Service Password Reset (SSPR) endpoint from a single source IP. The rule identifies a pattern of mixed response codes, specifically interleaving '50034' (Account does not exist) with successful or other outcomes, which indicates the use of automated tools to validate the existence of corporate accounts via response differentiation.
Detects successful authentication events using the OAuth 2.0 device code flow. While a legitimate authentication method for devices without web browsers, this protocol is frequently abused by attackers in 'device code phishing' attacks to harvest access tokens and gain unauthorized access to cloud and SaaS applications.
Page 40 of 150