Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects anomalous activity in Microsoft Graph API logs where a single user or application interacts with three or more distinct category endpoints (e.g., users, groups, mailfolders) and at least six unique paths within a 30-minute interval, suggesting reconnaissance or broad enumeration of the M365 tenant environment.
Detects high-volume, potentially automated data access, collection, or staging activities within Microsoft 365 services (SharePoint, OneDrive, and Exchange). The rule flags user identities performing a high count of operations (downloads, accesses, deletions, or export requests) across a wide range of unique objects or sites within a one-hour window, which is indicative of post-compromise mass data collection or exfiltration preparation.
Detects the addition of a new strong authentication method (MFA/authenticator device) to an account. This activity is a common indicator of persistence following a successful AiTM (Adversary-in-the-Middle) phishing attack or initial account compromise, as attackers establish their own MFA device to maintain long-term access.
Detects incoming or urgent security-themed emails (related to MFA, SSO, or passkeys) that originate from purported IT departments and are followed by a user clicking a link associated with Microsoft or authentication portals. This behavior is indicative of credential harvesting or consent phishing campaigns masquerading as internal IT security updates.
Detects anomalous, high-frequency cloud management API requests across multiple sensitive paths (such as directory roles, applications, and service principals) from a single account. This pattern is indicative of automated enumeration or discovery of cloud infrastructure, permissions, and identity configurations, which is often a precursor to further exploitation.
Detects anomalous, high-volume file download activity from SharePoint or OneDrive initiated through identified anonymous proxy services. This behavior suggests potential data exfiltration by an adversary attempting to mask their source IP address while offloading large amounts of data.
This rule detects high-volume interactions with the Exchange Online REST API originated from the 'One Outlook Web' application ID, specifically filtering for events with associated token IDs. This pattern may indicate automated mailbox data exfiltration or unauthorized bulk email access, which has been observed in recent phishing-based identity compromise campaigns.
Detects high-volume, automated access and download activity targeting sensitive data within Microsoft 365 services (SharePoint, OneDrive, and Exchange) using the Microsoft Graph API. The rule identifies suspicious patterns of URI access associated with file downloading and mail item access, which may indicate automated data exfiltration by an adversary using compromised credentials or OAuth tokens.
This rule detects phishing emails attempting to impersonate executive roles (CEO, CFO, President) or using ServiceNow-themed lures (invoices, approvals) to solicit unauthorized ACH or wire transfers. The detection logic focuses on suspicious sender domains, payment-related keywords, and executive-specific titles in the email body.
Detects anomalous, high-volume file access and download activity targeting SharePoint or OneDrive. This behavior is identified by the use of the python-httpx User-Agent, which is often associated with automated scripts for data collection and exfiltration in cloud-based intrusions.
Detects potentially unauthorized or anomalous activations of highly privileged Entra ID roles (e.g., Global Administrator). The rule identifies activations that lack a business justification, occur during unusual hours (outside of 06:00-22:00), or exhibit burst patterns of repeated activation/deactivation cycles which may indicate automated credential abuse or persistence attempts.
Detects a suspicious sequence of events where a user performs a device-code authentication followed by a device registration or PRT issuance within a 30-minute window. This behavior is indicative of an adversary using an OAuth device code flow to phish an initial access token, subsequently using it to register an adversary-controlled device for persistent access or to bypass Conditional Access policies.
This rule detects anomalous high-frequency search activity within Microsoft 365 environments targeting sensitive keyword terms like 'invoice', 'payment', 'wire', or 'bank.details'. The detection identifies users performing multiple searches across mailbox or graph activity within a short period, which may indicate account compromise or unauthorized email exfiltration attempts.
This rule detects high-volume, burst-pattern email distribution associated with a 'New VM Received' subject line, originating from non-authorized or non-corporate domains. This behavior is indicative of potential mass phishing or spam campaigns mimicking automated voicemail notifications.
Detects Microsoft Teams communication (calls, chats, messages) originating from a different tenant where the sender's display name is identified as IT Support, Help Desk, or similar. This behavior is indicative of external actors attempting to impersonate internal IT staff to facilitate social engineering or credential harvesting.
Detects modifications or additions to Multi-Factor Authentication (MFA) security information for high-value users, specifically targeting those with executive titles (Director, VP, President, etc.). This behavior is frequently associated with account takeover attempts where an attacker registers their own MFA device to a compromised privileged account to maintain persistence.
Detects anomalous high-volume file access or download activity in Microsoft 365 (SharePoint or OneDrive) by a single user within a 15-minute window, which may indicate bulk data exfiltration.
Detects anomalous high-volume file access or download activity in Microsoft 365 (SharePoint or OneDrive) by a single user within a 15-minute window, which may indicate bulk data exfiltration.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Page 54 of 179