Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects instances where a user successfully authenticates via the OAuth Device Code flow using an unmanaged or non-compliant device, followed closely by high-privileged Azure/Graph API administrative actions within a short timeframe. This behavior is indicative of a device-code phishing attack aimed at bypassing MFA controls, including FIDO2/passkeys, by compromising an active session.
This rule detects a multi-stage Business Email Compromise (BEC) attack involving executive impersonation via look-alike domains, followed by the creation of suspicious inbox rules (forwarding/deletion) by the victim, and concurrent external communication (Teams/Zoom meeting invites) from a newly created account. It correlates these activities to identify sophisticated payment fraud campaigns.
This rule detects potential 'Quishing' (QR code phishing) attempts by identifying email-based phishing detection or malicious URL indicators followed by a user clicking the URL and subsequently authenticating to a corporate system from a mobile device (Android or iOS) within a 30-minute window. This behavior often suggests an adversary successfully harvesting credentials via a QR code link and then using them to gain unauthorized access.
Detects instances where a user successfully authenticates to a cloud service (Azure AD) from an unrecognized ASN, device, or country without performing MFA, followed shortly by high-risk actions such as mailbox rule creation, mass file downloads, or OAuth application registration. This pattern is indicative of session cookie theft or OAuth token replay used to bypass MFA.
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
Detects a suspicious correlation where an employee's phone number undergoes a SIM change or number reassignment event, immediately followed by a successful login using SMS-based MFA for the same identity. This pattern is indicative of SIM swapping/hijacking attacks, often used by threat actors like Scattered Spider to bypass SMS-based multi-factor authentication.
Detects anomalous authentication behavior consistent with Adversary-in-the-Middle (AiTM) phishing attacks, specifically where an MFA-authenticated session is accessed from multiple, disjoint geographic locations or IP addresses within a short timeframe, indicating the replay of stolen session tokens.
Detects high-volume authentication failures originating from a single source IP targeting multiple unique user accounts, indicative of password spraying or credential stuffing attacks against cloud identity providers.
This rule monitors for suspicious network traffic to SMTP services and specific external email addresses, as well as process command lines containing these indicators. Additionally, it tracks email events involving specific sender, recipient, and subject indicators which may be indicative of unauthorized communication or data exfiltration attempts.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
This rule identifies potential prompt injection attempts against Microsoft Copilot and Azure OpenAI services by monitoring CloudAppEvents for specific adversarial markers, encoded instruction blocks, or hidden text patterns. It flags recurring attempts from a single user as suspicious probing activity.
This rule detects potential Business Email Compromise (BEC) attempts where external senders impersonate corporate executives (e.g., CEO, CFO) by spoofing display names or using lookalike/cousin domains. It triggers when these impersonations are combined with urgent, financial-themed language in the email subject line (e.g., wire transfers, payroll changes, or gift card requests).
This rule monitors incoming email events for potential phishing attempts by identifying messages from unknown sender domains (not seen in the last 90 days) that contain known AI-generated response phrases in the subject line or personalized content matching the recipient's display name. This helps detect spearphishing lures that attempt to build trust through impersonation or leverage LLM-generated phrasing common in automated phishing campaigns.
Detects the transmission of sensitive credential-like patterns (such as API keys, private keys, and connection strings) to known external AI coding assistant and IDE plugin endpoints. This rule monitors cloud application events originating from developer workstations or CI/CD runners where such sensitive information may be inadvertently or maliciously sent to third-party AI services.
Detects evidence of indirect prompt injection (IPI) attempts within email and document content processed by enterprise AI assistants. The rule flags instruction-hijack phrases, hidden obfuscation characters (e.g., zero-width, white-on-white text), and encoded blocks specifically targeting AI model behavior.
This rule identifies email patterns that involve either the presence of email attachments (specifically .eml or .msg files) or common email forwarding/reply indicators (e.g., 'FW:', 'FWD:', 'RE:'). By aggregating emails based on the sender and subject, it provides a summary of communication volume, which can be used to identify anomalous email activity or potential phishing staging/thread hijacking.
Detects high-velocity administrative activity performed by a single user account in Azure Active Directory, specifically focusing on account provisioning and role membership changes. The rule flags patterns such as password resets, enabling/disabling accounts, adding new users, and privilege escalation (e.g., granting Global Administrator roles), which are indicative of malicious post-compromise activity.
Page 42 of 179