Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects potential session hijacking of a Claude SaaS account by identifying sign-ins from unrecognized IP addresses followed by a high-volume burst of API usage or message activity that deviates from the account's established baseline.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
This rule detects anomalous OAuth authorization requests to Microsoft and Google services where the 'redirect_uri' parameter points to suspicious external domains (specifically ending in .vu) or, in the case of silent Microsoft OAuth requests, points to domains outside of recognized Microsoft/Office 365 infrastructure. Such abuse is often indicative of OAuth consent phishing campaigns designed to steal application access tokens.
This rule detects potentially malicious mailbox access patterns in Microsoft 365. It identifies instances where the 'MailItemsAccessed' action is performed using the Outlook ClientAppId, but in conjunction with an uncommon APIId and a suspicious user agent ('Client=REST' combined with specific Firefox versions). This pattern is indicative of automated session hijacking or unauthorized access via third-party tools rather than legitimate browser-based Outlook access.
Detects anomalous access to email items in Microsoft 365 Exchange environments by monitoring the 'MailItemsAccessed' operation. The rule flags specific, non-standard pairings of 'ClientAppId' and 'APIId' associated with malicious activity, indicating potential unauthorized data collection or exfiltration by attackers bypassing standard Outlook client behavior.
Detects non-interactive sign-in events to common Microsoft 365 applications (OfficeHome, Outlook, My Sign-Ins, My Profile) where the User-Agent identifies as an automated HTTP client library (Axios or Python-requests). This behavior is often indicative of programmatic access via stolen session cookies or application tokens, commonly seen in adversary activity such as payroll-related business email compromise.
Detects OfficeHome sign-in events featuring the 90014 error code (missing OAuth nonce). The rule looks for a specific mismatch where mobile browser User Agents are observed on a system reported as Windows 10, a pattern consistent with Adversary-in-the-Middle (AiTM) session token replay attacks attempting to access Microsoft 365 environments.
Detects anomalous Microsoft 365 session behavior where a single SessionId persists across multiple sign-ins that originate from rotating IP addresses and ASNs. The detection identifies signs of potential session token theft, specifically looking for traffic matching the Microsoft Outlook client app signature paired with non-standard user agents (e.g., Firefox or Python requests) that exhibit recurring sign-in attempts at approximately 8-hour intervals, which is typical for automated token refresh cycles.
Detects suspicious O365 'MailItemsAccessed' activity using a specific OAuth application (AppId c999ed3e-27ae-4cb3-b3a2-46b056af63d3) and ClientId (5d661950-3475-41cd-a2c3-d671a3162bc1) with an 'Bind' operation type. This pattern is often associated with unauthorized email access across multiple tenant accounts. The rule triggers when at least 5 events are detected across 2 or more distinct tenant accounts within a 1-minute window, using a specific Firefox user agent.
Detects anomalous sign-in activity where a single Microsoft 365 or Entra ID user account successfully authenticates from multiple distinct residential or mobile-carrier ASNs within a 24-hour window. This behavior is highly indicative of an adversary replaying stolen session tokens (AiTM) through rotating residential proxy networks to blend into legitimate user traffic and circumvent location-based or datacenter IP-based access restrictions.
Detects the creation or modification of O365 inbox rules designed to move incoming emails to the 'Deleted Items' folder, delete messages, or mark them as read. This behavior is a common indicator of an adversary attempting to hide phishing lures, security alerts, or C2 communications within a compromised mailbox.
Detects sign-in events using the OAuth 2.0 device code flow, which is a mechanism often abused in phishing campaigns (such as GhostCode) to lure users into authorizing malicious applications or granting access tokens without needing their actual credentials.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Detects potential device code phishing patterns where a successful OAuth device-code authentication is rapidly followed by Microsoft Graph resource access from the same account. The rule identifies suspicious polling sessions (e.g., EvilTokens) by monitoring for successful device-code sign-ins and immediate, subsequent Graph API activity. It filters known first-party applications and incorporates risk-based triggers and reconnaissance behavioral patterns to minimize false positives.
Detects potential abuse of stolen OAuth session tokens, where refresh tokens are used to authenticate after a user has performed a password reset. This rule identifies accounts that continue to sign in from previously unseen devices or IP addresses within 24 hours post-password reset, a technique consistent with session persistence mechanisms used by adversary tools and platforms like EvilTokens.
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
This rule monitors authentication activity within Microsoft Entra ID (formerly Azure AD) involving the Device Code flow. This flow is often abused by attackers through phishing to obtain access tokens. The rule detects and lists occurrences of authentication attempts leveraging the device code grant, facilitating the investigation of potentially malicious token acquisition or replay attacks.
Detects high-volume API requests to Exchange REST services using a specific application ID or Outlook Web branding, where the account object ID is missing. This pattern is indicative of potential OAuth token abuse, where an attacker utilizes a stolen token to perform automated actions without the presence of a legitimate user session.
Detects npm package publishing events performed via GitHub Actions OIDC trusted publishing that occur without the use of a traditional npm token. This rule targets potentially unauthorized package releases triggered by automated CI/CD identities, which may indicate abuse of compromised workflows or misconfigured auto-publish settings.
This rule detects forced pushes to the main branch of a GitHub repository where a specific file named 'indexe.cjs' is added or a specific commit ID (d1d55e13) is pushed. This behavior is indicative of a supply chain compromise where an attacker rewrites git history to inject malicious loaders or backdoors into the source code.
Page 44 of 142