Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects email activity containing keywords related to SSO or passkey updates combined with urgent terminology and support request language. This pattern is commonly indicative of phishing attempts aimed at stealing credentials or tricking users into providing sensitive information.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects high-volume, rapid enumeration of core Microsoft Graph directory endpoints (users, groups, applications, and servicePrincipals) by a single identity or session. This behavior is indicative of reconnaissance tools such as AADInternals, ROADtools, or TokenTactic being used to map out a cloud environment's directory structure.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects the addition or modification of federated domain trusts or identity provider settings within Entra ID. Such actions can be indicative of attackers establishing persistent access or implementing Golden SAML-style attacks by forging authentication assertions via a compromised or malicious identity trust.
Detects instances where a Temporary Access Pass (TAP) is assigned to a user account, followed by a sign-in from an unmanaged or non-compliant device within one hour. This behavior is indicative of potential help-desk impersonation (vishing) attacks where an adversary obtains a TAP to bypass standard authentication controls.
Detects a suspicious sequence of events indicative of social engineering. An administrator or help-desk account resets a user's password, followed within 15 minutes by the target user performing a successful MFA authentication from a device or IP address not associated with that user in the preceding 30 days, suggesting an attacker hijacked the session or coerced the user after the password reset.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
Aggregates password/MFA reset actions by the performing helpdesk identity, alerting on abnormal reset volume or resets outside a normal ticket pattern — a proxy for a support agent being repeatedly socially engineered or a fraudulent-ticket abuse pattern.
Flags re-enablement of legacy/basic authentication protocols or a new per-user authentication-policy exclusion occurring shortly after that account's MFA method was reset — the fallback technique used to sidestep modern MFA once the vishing playbook's reset step succeeds.
Detects the creation of mailbox inbox rules (New-InboxRule) or modification of mailbox forwarding configurations (Set-Mailbox) that auto-forward, auto-delete, or move messages to hidden or secondary folders (e.g., RSS, Deleted Items). This behavior is characteristic of Business Email Compromise (BEC) follow-on activity intended to maintain covert access to victim communications, particularly following account takeover events like password resets.
Detects the removal of phishing-resistant authentication methods (FIDO2 or Windows Hello for Business) and the registration of weaker, phishable MFA methods (SMS, voice, or phone app) within Entra ID. This behavior is indicative of an attacker attempting to lower the security posture of an account to facilitate future credential theft or unauthorized access.
This rule detects the creation or modification of Exchange mailbox rules (Forward, Redirect, Delete, or Mark as Read) involving sensitive keywords (invoice, wire, payment, finance, remittance) shortly after an anomalous sign-in event or a password reset on the same account. This combination is a strong indicator of account takeover and mailbox persistence.
Detects instances where a user grants OAuth application permissions for high-risk scopes (e.g., mail access, offline access). The rule flags these grants, with higher risk scores assigned if the application publisher is unverified or unknown, helping identify potential illicit consent grant attacks often used to maintain long-term persistence in cloud environments.
Detects user-granted OAuth consent in Microsoft Entra ID (formerly Azure AD) involving high-risk scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This pattern is characteristic of illicit consent-grant phishing, where attackers entice users to authorize malicious applications to bypass multi-factor authentication (MFA) and establish persistent, programmatic access to sensitive mailbox and file resources.
Detects high-volume email inflow to a single recipient mailbox within a 15-minute timeframe. The rule specifically monitors for subject lines commonly associated with subscription confirmations or newsletters, indicating a potential email bombing or mail flood attack designed to overwhelm a user's inbox or hide malicious communications.
Detects Microsoft 365 Exchange MailItemsAccessed operations performed by a specific ClientAppId and AppId known to be associated with an exfiltration toolkit. This activity indicates unauthorized access to mail items, consistent with data harvesting efforts.
Detects anomalous SharePoint search activity that uses 'indexdocid' queries targeting specific site or web content classes. This pattern is often indicative of automated reconnaissance or enumeration of documents within a SharePoint environment, potentially attempting to bypass standard UI navigation to identify or access sensitive content.
Page 43 of 179