Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects anomalous, high-volume file access or preview activity in OneDrive or SharePoint from non-browser user agents. This pattern is indicative of potential data exfiltration where adversaries use scripted clients or APIs to mass-read or preview files, bypassing traditional download-based alerts.
Detects anomalous activity associated with AI and LLM service providers by identifying accounts that are either interacting with these services for the first time or exhibiting a significant spike in API call volume compared to their 14-day historical baseline. This pattern may indicate unauthorized use of enterprise AI resources, potential persistence mechanisms, or exfiltration activities abusing legitimate LLM orchestration APIs.
Detects downstream delivery of likely AI-paraphrased mass-produced lure content by identifying bursts of near-duplicate subject lines from newly-seen domains with auth failures.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects accounts showing a spike in requests to public generative-AI services compared to their historical baseline, combined with anomalous indicators like multiple source IPs, regions, or off-hours activity.
Detects accounts showing a spike in requests to public generative-AI services compared to their historical baseline, combined with anomalous indicators like multiple source IPs, regions, or off-hours activity.
Detects instances where a single user account exhibits an anomalously high frequency of requests to public generative-AI platforms within a one-hour window, potentially indicating automated reconnaissance or data staging activities using AI tools.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects potential session hijacking of a Claude SaaS account by identifying sign-ins from unrecognized IP addresses followed by a high-volume burst of API usage or message activity that deviates from the account's established baseline.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects phishing emails masquerading as legitimate DocuSign remittance advice notifications. The rule identifies emails containing specific keywords related to PDF sharing or remittance advice originating from 'docusign' and featuring suspicious, alternating-case hyperlinks often used in credential phishing campaigns.
This rule detects phishing emails associated with the 'AnonyMousKIT' campaign that spoof Apple-related services ('Find My', 'Apple Support') using common adversary-controlled Gmail/iCloud addresses. The rule specifically targets institutional recipients in .gov, .edu, and .ac domains, identifying potential credential harvesting attempts despite the campaign's original consumer-focused pretext.
This rule monitors email traffic for attachments with suspicious file types (.htm, .xhtml, .svg, .zip) or specific filenames commonly used in phishing campaigns. It focuses on emails associated with Amazon SES infrastructure, often indicative of phishing attempts leveraging reputable infrastructure to deliver malicious content or stager files.
Detects potential token-replay persistence by identifying repeated 'MailItemsAccessed' events for the same user account from a non-native 'REST' and 'Firefox' client string, recurring at consistent ~30-minute intervals.
This rule detects potentially malicious mailbox access patterns in Microsoft 365. It identifies instances where the 'MailItemsAccessed' action is performed using the Outlook ClientAppId, but in conjunction with an uncommon APIId and a suspicious user agent ('Client=REST' combined with specific Firefox versions). This pattern is indicative of automated session hijacking or unauthorized access via third-party tools rather than legitimate browser-based Outlook access.
Detects anomalous access to email items in Microsoft 365 Exchange environments by monitoring the 'MailItemsAccessed' operation. The rule flags specific, non-standard pairings of 'ClientAppId' and 'APIId' associated with malicious activity, indicating potential unauthorized data collection or exfiltration by attackers bypassing standard Outlook client behavior.
Detects suspicious O365 'MailItemsAccessed' activity using a specific OAuth application (AppId c999ed3e-27ae-4cb3-b3a2-46b056af63d3) and ClientId (5d661950-3475-41cd-a2c3-d671a3162bc1) with an 'Bind' operation type. This pattern is often associated with unauthorized email access across multiple tenant accounts. The rule triggers when at least 5 events are detected across 2 or more distinct tenant accounts within a 1-minute window, using a specific Firefox user agent.
Detects anomalous sign-in activity where a single Microsoft 365 or Entra ID user account successfully authenticates from multiple distinct residential or mobile-carrier ASNs within a 24-hour window. This behavior is highly indicative of an adversary replaying stolen session tokens (AiTM) through rotating residential proxy networks to blend into legitimate user traffic and circumvent location-based or datacenter IP-based access restrictions.
Page 45 of 179