Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,535
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects web traffic directed towards Google Apps Script endpoints that exhibit characteristics of malicious activity, specifically targeting browser-side data collection and user interaction lures. The rule identifies potential phishing attempts by correlating access to Google Apps Script pages (e.g., sidebars or add-ons) with external document-based referrers (e.g., Google Docs) or social media referrers, combined with scripts that attempt to exfiltrate user device environment data, location, or cryptocurrency wallet information.
Detects anomalous, high-frequency MFA method resets, deletions, or updates performed by a single administrative account within a 15-minute window. This activity is indicative of a compromised support or helpdesk account being leveraged to bypass multi-factor authentication across multiple user accounts for unauthorized access or account takeover.
Detects modifications to Entra ID (Azure AD) Conditional Access policies where a user or group is explicitly added to an exclusion list. This behavior can be used by adversaries to bypass mandatory Multi-Factor Authentication (MFA) or device compliance requirements, facilitating persistence on a compromised account.
Detects a suspicious pattern where a user account experiences a burst of multiple MFA failures followed by an anomalous successful authentication within a short 15-minute window. This behavior is indicative of automated MFA fatigue attacks or attempts to exploit MFA bypass vulnerabilities.
Detects anomalous mass consent grants to OAuth applications by users within the environment. This rule monitors for high-risk permissions such as Mail.Read and Files.ReadWrite.All, which are commonly used in consent phishing and application-based persistence campaigns to gain unauthorized access to mailbox and file resources.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
Detects high-volume, potentially programmatic search activity in Microsoft 365 SharePoint, characterized by iterative pagination requests using the 'indexdocid' parameter. This behavior may indicate an automated effort to crawl or systematically exfiltrate document metadata or content via the SharePoint search interface, often associated with post-exploitation discovery or unauthorized data collection.
Detects high-volume, potentially programmatic search activity in Microsoft 365 SharePoint, characterized by iterative pagination requests using the 'indexdocid' parameter. This behavior may indicate an automated effort to crawl or systematically exfiltrate document metadata or content via the SharePoint search interface, often associated with post-exploitation discovery or unauthorized data collection.
Detects high-frequency, automated polling of Microsoft 365 mailbox data via the Microsoft Graph API, characteristic of malicious inbox scanning tools (e.g., Box Monitor). The rule correlates these persistent access patterns with subsequent searches for high-value financial keywords, identifying potential Business Email Compromise (BEC) reconnaissance.
Detects anomalous activity where a user performs a device-code authentication followed rapidly by a device registration event and the subsequent issuance of a Primary Refresh Token (PRT) or x-ms-RefreshTokenCredential. This pattern is often indicative of OAuth device-authorization flow abuse, where an adversary attempts to register a malicious device to gain persistent access.
Detects high-frequency, automated access to mail items via Microsoft Graph API (mail.read/MailItemsAccessed), consistent with automated scanning or exfiltration tools like ARToken's Inbox Monitor. The rule identifies suspicious patterns of repetitive access to mailbox folders or messages that may indicate Business Email Compromise (BEC) or automated credential-based harvesting.
This rule monitors authentication events for the 'deviceCode' protocol where multi-factor authentication (MFA) was not required or completed. This is a common indicator of device code phishing attacks, where an adversary lures a user into authorizing a malicious device or application, often bypassing organizational MFA policies.
Detects access to Microsoft Graph API endpoints related to mail, contacts, drive, or messages from a device that was registered within the last 24 hours. This behavior may indicate an adversary using stolen session tokens or credentials to access cloud-based email and data shortly after device registration or enrollment.
Detects interactive sign-ins to Microsoft Entra ID using the OAuth 2.0 device authorization grant flow. Attackers commonly abuse this flow in 'device code phishing' campaigns to capture access and refresh tokens, effectively bypassing MFA requirements.
Page 52 of 142