Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects an administrator account rapidly granting mailbox permissions (Add-MailboxPermission, Add-RecipientPermission, Set-MailboxFolderPermission) to a large number of objects within a short timeframe (15 minutes). The rule correlates this activity with a prior 'risky' sign-in or a sign-in using device-code flow, indicative of potential EvilToken or similar adversary-in-the-middle proxy-based session hijacking.
Detects high-volume deletion or recycling of files within OneDrive or SharePoint for a specific user, which may indicate malicious activity such as data destruction, ransomware, or unauthorized data exfiltration staging.
This rule monitors for indicators of compromise (IOCs) associated with the ShinyHunters threat actor, including specific malicious domains, IP addresses, and artifacts found in command lines or event data. It aggregates telemetry from network events, Entra ID sign-in logs, cloud application activity, email logs, process execution, and general device events to detect interaction with known malicious infrastructure or execution of threat-actor specific artifacts.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
Detects successful authentication events for accounts that have been dormant for at least 90 days, correlated with suspicious activity markers such as recent failed sign-in attempts, access from an unfamiliar geographic location or ASN, or a complete absence of historical sign-in activity.
Detects successful authentication events for accounts that have been dormant for at least 90 days, correlated with suspicious activity markers such as recent failed sign-in attempts, access from an unfamiliar geographic location or ASN, or a complete absence of historical sign-in activity.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
This rule detects instances where a user grants high-risk OAuth application permissions (e.g., Mail or Files access) within 30 minutes of a risky or MFA-challenged sign-in event. This pattern is indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker successfully steals a session and immediately establishes persistent access to the victim's resources via OAuth consent.
Detects the reuse of a single authenticated session or refresh token from multiple distinct IP addresses or ASN origins within a short timeframe following a successful MFA event. This pattern is indicative of session hijacking, where an adversary uses an Adversary-in-the-Middle (AiTM) toolkit (e.g., Evilginx) to capture a valid session cookie from a victim and replay it from their own infrastructure to bypass authentication.
Detects a suspicious authentication pattern involving 3 or more MFA failures within 15 minutes, immediately followed by an MFA success for the same user. This pattern is characteristic of potential Adversary-in-the-Middle (AiTM) activity, where an attacker intercepts a session or MFA token and relays it through separate infrastructure, while the legitimate user's own MFA attempts fail or time out.
Detects successful sign-in events flagged by the identity provider with risk indicators suggesting session token replay or theft. This includes anomalies such as unexpected token issuers, suspicious browsers, or unfamiliar device features, which are characteristic of session cookie theft and replay attacks.
Detects instances where a suspicious login event (such as a risk challenge) is immediately followed by a credential or recovery information modification. This pattern may indicate an adversary is attempting to take over a compromised account by resetting the password or recovery details after triggering a security alert.
Detects SAML token authentication events where the token-signing certificate does not match the established federation baseline (indicating potential token forging or unauthorized IdP activity) or where critical conditional access claims (MFA and device compliance) are missing from the SAML assertion.
This rule detects two suspicious patterns related to authentication: (1) 'MFA Fatigue' or 'Push Bombing' where a user experiences a high volume of MFA push denials followed by an acceptance in a short timeframe, and (2) potential account takeover where a help-desk initiated password reset is followed by an MFA re-registration or new device enrollment by the same user within 30 minutes.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Page 40 of 142