Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,933
7,264
6,535
3,865
3,644
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
This rule detects potential phishing activity by correlating specific email subjects or sender addresses with subsequent user clicks on suspicious links. It identifies when users receive emails with subjects related to invoices or payment confirmations, or from specific known-bad sender domains, and then follows up by tracking interactions (clicks) with domains or patterns associated with the phishing lures (SharePoint, Adobe, verification, or device code login URLs).
This rule detects the creation or modification of inbox rules in Microsoft 365 that exhibit suspicious behaviors, such as hiding messages, deleting them, moving them, or automatically forwarding/redirecting them to external addresses. It also flags rules that contain finance-related keywords, often used in Business Email Compromise (BEC) campaigns.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects suspicious Entra ID device registration and Primary Refresh Token (PRT) issuance occurring shortly after an OAuth Device Code sign-in. This pattern is indicative of ARToken-style post-compromise persistence, where an attacker leverages a stolen device code to register a rogue device and establish a persistent session.
Detects Microsoft 365 MailItemsAccessed events where the email subject or body contains finance-related keywords such as 'invoice', 'payment', 'bank details', or 'wire'. This activity may indicate malicious mailbox scanning or data collection, often associated with unauthorized access or automated enumeration tools like the ARToken Inbox Monitor.
Detects phishing emails leveraging finance or accounts-payable themes (e.g., invoices, payment confirmations, bank detail updates) that contain known ARToken phishing template strings. This activity is indicative of credential harvesting via device code authorization flow abuse.
Detects automated mailbox access operations such as 'MailItemsAccessed' or 'Search-Mailbox' that are filtered by specific, high-risk financial or Business Email Compromise (BEC) keywords in the email subject line. This behavior is indicative of an automated 'inbox-monitor' style attack, where a compromised OAuth token is used to systematically scrape mailboxes for sensitive financial data.
Detects multiple anomalous sign-in events using the device-code authentication flow within an Entra ID tenant. The rule correlates sign-ins from geographically disparate IP addresses (often associated with known attacker infrastructure or proxies) using device-code flows, which is a technique used in 'ARToken' style phishing campaigns to compromise multiple user accounts in a short timeframe.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule detects modifications to Group Policy Objects (GPO) or Microsoft Entra (formerly Azure AD) policies that weaken established security controls. For GPO, it monitors Event ID 5136 for changes to security-relevant attributes (e.g., disabling firewall or real-time monitoring) in Active Directory. For Entra, it monitors audit logs for administrative operations that reduce security posture, such as disabling MFA, lowering authentication trust, or deleting Conditional Access policies. It includes filters to exclude legitimate, documented change management activities.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects high-volume, potentially malicious email campaigns characterized by discount-themed subject lines containing keywords like '65% off' and links pointing to '.shop' domains. The rule identifies suspicious patterns by aggregating events and flagging instances where multiple users are targeted with similar subjects and domains, excluding those specifically allowlisted.
This rule detects network communication, email interaction, or identity logon events related to known spoofed IC3 (Internet Crime Complaint Center) domains used in business email compromise (BEC) campaigns. The detection covers multiple telemetry sources including email URL information, device network events, and identity logon logs to identify attempts to interact with fraudulent portals.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects incoming emails to finance or accounts payable aliases that contain urgent payment-related keywords and suspicious patterns, such as subject lines including dollar amounts or emails where the Reply-To address domain differs from the Sender domain. This activity is highly indicative of BEC fraud attempts targeting payment redirection.
Detects successful post-delivery email remediation actions (such as ZAP, manual deletion, or moving to junk) performed on emails associated with the Operation DoppelBrand campaign, identified by specific sender domains (service-nowinc.com, domainlify.net) or suspicious invoice-fraud subject lines.
Page 54 of 150