Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects a multi-stage phishing attack, often referred to as 'quishing'. It identifies incoming emails containing image (JPG, PNG) or PDF attachments that embed previously unseen URLs, correlated with a subsequent sign-in event from a mobile device by the same recipient, which is a common indicator of Adversary-in-the-Middle (AiTM) credential harvesting.
Detects the creation or modification of inbox rules (e.g., forwarding, redirecting, deleting, or moving to hidden folders) that target finance, invoice, or payment-related communications, occurring shortly after an initial user sign-in from a new or unseen country/ASN within the last 30 days. This pattern is indicative of a post-compromise activity where an adversary attempts to exfiltrate financial data or hide malicious email activity.
This rule detects when a user grants OAuth application permissions for high-risk scopes (e.g., Mail, Files) to an application that was registered within the last 7 days. It correlates this event with subsequent suspicious actions performed by the same user, specifically mailbox rule modifications or file download activity, which are common indicators of post-compromise activity following OAuth consent phishing.
Detects instances where a user account modifies security information, registers a new MFA method, or resets a password shortly after a successful sign-in from a country not observed for that user within the previous 30 days. This pattern is indicative of potential account takeover where an adversary adds persistence or MFA bypass methods to a newly compromised account.
Detects phishing emails containing suspicious URLs pointing to PaaS platforms (Azure Static Web Apps, Cloudflare, Firebase) that exhibit credential harvesting characteristics (branded keywords or base64 patterns). The rule correlates these emails with subsequent clicks and a successful M365 sign-in by the same user within 30 minutes of the click, indicating a probable successful credential compromise.
This rule detects mass phishing campaigns by identifying HTML/HTM email attachments that contain embedded URLs. It monitors for a pattern where the same sender distributes these attachments to multiple recipients, a common behavior for HTML smuggling delivery vectors where malicious payloads are constructed client-side to bypass static email gateway inspection.
Detects a sequence of suspicious activities associated with EvilTokens-style session hijacking. This includes the identification of non-interactive sign-in events involving the redemption of a refresh token without secondary MFA, followed by the creation or modification of Exchange Online mailbox rules to facilitate unauthorized email forwarding or exfiltration.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects high-volume, individually-tailored spear-phishing campaigns likely assisted by Generative AI. The rule monitors for a single sender targeting a high number of unique recipients with distinct, non-identical email subjects within a short timeframe. It specifically flags activity involving newly registered look-alike domains and interactions with credential-harvesting patterns in URLs.
Detects a suspicious sequence of events where a user engagement (voice/video call) involving themes of urgency or helpdesk interaction is closely followed by a high-risk administrative action (e.g., password reset, MFA device enrollment, or financial transfer) by the same user, where the communication session context differs from standard activity, indicative of a deepfake-enabled vishing attack.
Detects multiple MFA push notifications generated within a short timeframe for a single user during a Self-Service Password Reset (SSPR) flow. This behavior is indicative of an attacker attempting to perform MFA fatigue/push harassment to gain unauthorized access via SSPR or to bypass account security controls.
Detects a suspicious sequence where an account undergoes a help-desk-initiated password or credential reset, followed shortly (within 30 minutes) by the registration of a new multi-factor authentication (MFA) device for that same account. This pattern is characteristic of social engineering attacks, such as those used by UNC3944/Scattered Spider, where an adversary impersonates a user to gain initial access and subsequently establishes persistence by adding an MFA device they control.
Detects a pattern of MFA fatigue or 'push-bombing' where a user receives 5 or more MFA challenge requests within 10 minutes, immediately followed by a successful authentication event. This pattern is characteristic of attackers who have obtained user credentials and are attempting to bypass MFA by repeatedly triggering push notifications until the user grants access.
Detects a suspicious sequence of administrative actions where a user's phishing-resistant multi-factor authentication (MFA) factor, such as FIDO2, passkeys, or certificates, is removed and immediately replaced by a weaker authentication method like SMS, voice call, or TOTP. This behavior, when performed by an administrator account on a different user account, is a common indicator of an MFA bypass attempt often associated with social engineering or insider threat scenarios.
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects suspicious account management activities, such as password resets or MFA re-enrollment, performed by an operator on a high-privileged or administrator account outside of typical business hours (06:00-20:00). This behavior is often indicative of help-desk impersonation or credential takeover attempts targeting Identity Provider (IdP) administrative roles.
Detects instances where an account assigned a help-desk or support role performs an MFA, password, or credential reset on an account tagged as an executive or VIP. This behavior is indicative of social engineering and help-desk impersonation attacks commonly utilized by threat actors to perform rogue MFA takeovers.
Page 48 of 179