Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects the creation or modification of Microsoft Power Automate flows that integrate internal Microsoft 365 services (SharePoint, OneDrive, Exchange) with external communication or exfiltration targets (HTTP requests, external email addresses, or common external web services). This behavior is often indicative of automated data exfiltration.
Detects the creation or modification of Microsoft Power Automate flows that integrate internal Microsoft 365 services (SharePoint, OneDrive, Exchange) with external communication or exfiltration targets (HTTP requests, external email addresses, or common external web services). This behavior is often indicative of automated data exfiltration.
This rule detects the presence of files matching known SHA256 hashes associated with the GhostCode phishing kit. It monitors for these files both in email attachments and on local device filesystems to identify potential delivery and execution of malicious phishing payloads.
Detects instances where an Entra ID application or service principal has new secrets or certificates added by a user who is not a registered owner of that application. This behavior is a common technique for establishing stealthy persistence in a cloud environment.
Detects the creation or modification of Microsoft Power Automate flows that integrate internal Microsoft 365 services (SharePoint, OneDrive, Exchange) with external communication or exfiltration targets (HTTP requests, external email addresses, or common external web services). This behavior is often indicative of automated data exfiltration.
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Correlates new OAuth application consent grants with a preceding helpdesk-driven password/MFA reset on the same user, catching attacker-installed OAuth persistence — echoes the 2026 Vercel/Context.ai OAuth-abuse incident that followed a similar trust-granting pattern.
Detects anomalous mass consent grants to OAuth applications by users within the environment. This rule monitors for high-risk permissions such as Mail.Read and Files.ReadWrite.All, which are commonly used in consent phishing and application-based persistence campaigns to gain unauthorized access to mailbox and file resources.
This rule detects potential MFA fatigue attacks (Push Bombing) by monitoring sign-in logs for a high volume of authentication prompts directed at a single user within a one-hour window. It specifically identifies patterns where a user receives multiple denied MFA push requests followed by at least one successful approval. The rule also accounts for suspicious behavior such as requests originating from multiple IP addresses or geographic locations.
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks by identifying an initial legitimate sign-in followed by a second sign-in from a different IP address within a short timeframe (indicative of session token replay), immediately succeeded by high-risk post-compromise actions such as OAuth application consent or the creation of malicious mailbox rules.
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
Detects emails containing a RAR attachment combined with a shortened URL. This combination is a common technique used in phishing campaigns to deliver malicious payloads while attempting to evade security filters.
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
This rule detects interaction with specific infrastructure identified as deceptive dating applications. It monitors network communication, sign-in attempts, email interactions, and endpoint execution associated with known malicious domains (e.g., archat.us, heyhru.com, sitin.ai), specific IP addresses (38.129.138.244), and unique package identifiers (com.cavalier.nalo, com.qiga.vio). The detection logic spans across DeviceNetworkEvents, EntraIdSignInEvents, EmailUrlInfo, EmailEvents, DeviceEvents, and DeviceProcessEvents to identify exposure to these Indicators of Compromise (IOCs) across both network and endpoint layers.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
This rule detects potential large-scale phishing campaigns by identifying email traffic patterns involving URLs hosted on the 'workers.dev' domain. It looks for a high volume of unique recipients and unique subject lines within a short timeframe, which is indicative of automated, mass-distributed phishing lures often used to evade traditional URL reputation filters.
Page 52 of 179