Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,535
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects high-frequency, diverse Microsoft Graph API requests initiated by an identity, indicative of automated reconnaissance or enumeration of the cloud environment. The rule tracks requests across multiple categories such as organization settings, user/group identities, privilege information, application configurations, and resource access within a 30-minute window.
This rule monitors email, SMS, and voice logs for potential phishing attempts targeting user credentials. It specifically looks for social engineering lures related to passkey, SSO, or MFA updates that express urgency or imply service expiration, often masquerading as IT support communications.
Detects anomalous access patterns to Microsoft 365 SaaS applications where a single user session interacts with three or more specific portal applications (such as 'OfficeHome', 'My Apps', 'My Profile') within a five-minute window. This behavior may indicate an adversary attempting to map the environment or interact with multiple integrated services shortly after gaining access.
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
Detects high-frequency authentication failures in Entra ID (Azure AD) originating from External Authentication Method (EAM) providers. The rule identifies instances where the external identity token fails signature or key-ID validation (AADSTS50012/AADSTS70002), which may indicate configuration issues with the external IdP or attempts to forge authentication tokens.
Detects high-frequency authentication failures in Entra ID (Azure AD) originating from External Authentication Method (EAM) providers. The rule identifies instances where the external identity token fails signature or key-ID validation (AADSTS50012/AADSTS70002), which may indicate configuration issues with the external IdP or attempts to forge authentication tokens.
Detects high-frequency access to multiple sensitive Microsoft Graph API paths (users, groups, applications, directoryRoles, servicePrincipals, etc.) from a single identity within a short timeframe. This pattern is indicative of automated reconnaissance or enumeration of the cloud environment's identity and application landscape.
Detects a potential Adversary-in-the-Middle (AiTM) attack sequence by correlating OneDrive/SharePoint document sharing email lures with subsequent successful Microsoft 365 sign-ins from unusual locations or user agents within a short time window. This activity often indicates session cookie theft and MFA bypass.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
This rule detects potentially malicious messages sent via Microsoft Teams that contain keywords related to passkey enrollment or SSO updates, which are common social engineering tactics used in phishing campaigns to trick users into compromising their account credentials or security settings.
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Detects high-volume, multi-endpoint enumeration activity against the Microsoft Graph API, involving a high frequency of requests across sensitive tenant resources (users, groups, applications, roles, mailboxes, etc.). This behavior is consistent with post-compromise reconnaissance by an adversary attempting to map the environment.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365 authentication flows. It identifies suspicious proxy traffic that contains authentication-related URIs or session-related cookies (such as ESTSAUTHPERSISTENT or refresh tokens) originating from hosts other than recognized Microsoft domains. This behavior is indicative of an attacker using a reverse proxy, such as Evilginx2, to intercept user credentials and session cookies in real-time.
This rule detects anomalous backend activity associated with phishing kits, specifically monitoring for the dispatch of SMS or WhatsApp messages containing lure links. It identifies logs indicative of automated message dispatch (via send_sms_apix.log or WhatsApp Business API calls), filters for successful delivery indicators while excluding known error states, and verifies the presence of specific message components like recipient details and malicious templates.
Detects a specific device-intelligence workflow pattern where an operator performs device reconnaissance (e.g., serial number checks, device model lookups) followed shortly by the generation of a malicious lure or tracking link (e.g., Five-channel lure), indicative of an attempt to gain unauthorized access to a victim device or account.
Detects Workday self-service banking detail changes occurring shortly after suspicious mailbox reconnaissance activities, such as searching for payroll-related terms or accessing sensitive documents. This behavior is indicative of a payroll diversion fraud scheme following an Adversary-in-the-Middle (AiTM) session hijacking attack.
Detects OfficeHome sign-in events featuring the 90014 error code (missing OAuth nonce). The rule looks for a specific mismatch where mobile browser User Agents are observed on a system reported as Windows 10, a pattern consistent with Adversary-in-the-Middle (AiTM) session token replay attacks attempting to access Microsoft 365 environments.
Detects the abuse of the Google Meet 'linkredirect' service to facilitate phishing attacks, commonly used to bypass security filters and redirect users to Adversary-in-the-Middle (AiTM) phishing landing pages.
Detects the creation or modification of O365 inbox rules designed to move incoming emails to the 'Deleted Items' folder, delete messages, or mark them as read. This behavior is a common indicator of an adversary attempting to hide phishing lures, security alerts, or C2 communications within a compromised mailbox.
Detects Microsoft Entra OAuth 2.0 device authorization grant flow completion immediately followed by non-interactive API access from automated user agents like python-requests. This behavior is indicative of device code phishing kits, where an attacker tricks a user into entering a code and then programmatically hijacks the resulting session token.
Page 55 of 142