Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,865
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects a sequence of authentication events indicative of Adversary-in-the-Middle (AiTM) phishing, where a user session experiences MFA-related errors (50074, 50140) followed by a successful sign-in (0). This pattern suggests an adversary proxying credentials and MFA requests in real-time.
Detects anomalous, high-volume file access or download activity in Microsoft SharePoint Online or OneDrive for Business originating from a 'python-httpx' user agent. This pattern often indicates automated data collection or exfiltration attempts using programmatic tools.
Detects anomalous, low-volume data access behavior within cloud applications (such as file downloads, previews, or mail access) that is sustained over an extended period. This pattern often indicates slow, deliberate data exfiltration designed to evade volume-based detection thresholds.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects a suspicious sequence of events where a user initiates a device code authorization flow, immediately followed by a Microsoft Authentication Broker sign-in using the 'sso_reload=true' parameter. This pattern is indicative of an attacker hijacking the device code authorization process to gain unauthorized access to a user's session.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
This rule identifies network activity, email URLs, and DNS queries associated with a specific set of known malicious domains often used in phishing or credential harvesting campaigns. By aggregating telemetry from EmailUrlInfo, EmailEvents, DeviceNetworkEvents, and DnsEvents, the rule flags any interactions with these indicators of compromise.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
Detects the creation of email inbox rules in Microsoft 365 where the rule name is exceptionally short ('.' or '..') and the rule performs potentially malicious actions such as forwarding, redirecting, or deleting incoming messages. This is a common technique used by attackers to hide malicious email activity or exfiltrate sensitive data from a compromised account.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects phishing emails containing URLs with IPv6-mapped IPv4 addresses (e.g., [::ffff:192.168.0.1]). Adversaries use this obfuscation technique to bypass security filters that may not correctly parse or normalize IPv6-mapped addresses within URLs.
Detects coordinated email phishing campaigns by normalizing email subjects to identify recurring templates and flagging those sent to a high volume of recipients across multiple organizations within a short timeframe. The rule specifically targets financial and urgent pretexts from external senders, similar to observed techniques in impersonation campaigns.
Detects a single user account downloading or accessing a high volume of files (more than 50) within a 15-minute window from SharePoint or OneDrive. This behavior often indicates automated data collection, potential mass exfiltration, or a compromised user account account accessing sensitive files in bulk.
This rule detects potentially unauthorized mailbox content exports within Microsoft 365, including the creation of mailbox export requests, PST-related compliance searches, and the downloading of exported search results. These activities are common precursors to data exfiltration.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
Page 53 of 150