Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,921
7,246
6,535
3,864
3,627
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects instances where a user account experiences multiple failed sign-in attempts followed by a successful sign-in from a different, geographically distant location within a short timeframe, indicating impossible travel and potential credential compromise.
This rule detects potential social engineering attacks where an attacker initiates a Microsoft Teams call from an external domain while impersonating an internal IT support or help desk entity. The detection specifically correlates this event with a recent preceding email bombing campaign (exceeding 20 emails) targeting the same user within the last 3 hours, indicating a coordinated attempt to pressure or confuse the victim.
Detects high-volume mailbox access (exceeding 50 items) performed by a specific API/Client ID pair associated with known mailbox exfiltration tools. This behavior is indicative of unauthorized automated data collection or harvesting from an Office 365 Exchange environment.
This rule monitors incoming emails by cross-referencing sender addresses against a hardcoded list of known malicious or suspicious email accounts. It associates these emails with any potential attachments to provide context for further investigation.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
This rule detects potentially malicious outbound email activity sent through Microsoft Graph or Exchange APIs using unknown or infrequently seen client applications. It identifies scenarios where these applications send emails containing financial keywords (e.g., 'invoice', 'wire transfer'), which is a common indicator of Business Email Compromise (BEC) and 'EvilTokens' style mail-vault activity where attackers intercept or inject themselves into existing financial threads.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
This rule identifies emails containing URLs associated with known suspicious or malicious domains (secboxes.com, msbenefit.com, attcdn.com, brianwilli.com). It filters for instances where the sender's domain is not one of the identified suspicious domains to reduce noise from potential email spoofing or miscategorized communications, flagging potential phishing attempts.
Detects user account logins following a recent MFA registration (within 1 to 30 days) combined with subsequent network activity that utilizes node.js applications to query the Microsoft Graph API, which may indicate account takeover or malicious persistence setup.
Detects high-volume or multi-mailbox activity in Exchange Online, indicative of automated mailbox collection or unauthorized bulk data access via Graph or REST APIs. The rule monitors for a threshold of operations across multiple mailboxes or high event counts originating from specific API clients.
Detects signs of Adversary-in-the-Middle (AiTM) phishing attacks targeting cloud authentication. The rule monitors for access to suspicious domain patterns often used in AiTM phishing kits, specific MFA interruption errors (50074/50140) characteristic of proxy-based flows, and rapid successful logins from different IP addresses within a 15-minute window, suggesting session token theft and replay.
Detects potential lateral phishing attempts within Microsoft Teams by identifying a single user account sending messages containing common credential-harvesting lures (e.g., 'passkey', 'SSO', 'MFA', 'security update') to multiple internal recipients in a short timeframe.
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
This rule detects potentially malicious, automated enumeration of Microsoft Graph API endpoints. It monitors for high volumes of requests (>= 8 within a 15-minute window) that utilize multiple OData pagination, filtering, and search parameters such as $top, $skip, $skiptoken, $count, /delta, and /search. Such activity is often indicative of automated reconnaissance, data scraping, or unauthorized bulk enumeration of cloud directory resources.
Detects individual access events to sensitive Microsoft Graph control-plane endpoints, including directory roles, role management, authentication methods, applications, service principals, and OAuth permissions. This rule is designed to be paired with a broader correlation rule to identify potential reconnaissance or persistence activities involving high-privilege configuration changes.
Page 51 of 150