Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,933
7,264
6,535
3,865
3,644
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule detects anomalous interaction with the Microsoft Graph API by monitoring for high-frequency requests across multiple functional categories (e.g., tenant, directory, privilege, application, repository, mailbox) from a single identity. A large number of distinct API paths across multiple categories in a short time frame is indicative of an attacker performing reconnaissance or automated environment enumeration.
Detects internal phishing messages sent via Microsoft Teams that contain common credential-harvesting lures (e.g., passkey, MFA, SSO updates) where the sender account has also exhibited indicators of compromise within the preceding 24 hours, such as risky sign-ins or impossible travel.
Detects anomalous, high-frequency file access (100+ files within a 2-hour window) in Microsoft 365 (SharePoint or OneDrive) by users employing a Python-based HTTP client (python-httpx). This behavior is often indicative of automated data scraping, exfiltration, or bulk download activities performed by unauthorized scripts or compromised service accounts.
Detects specific authentication failure codes (50074, 50140) associated with MFA bypass and session persistence interruptions, which are characteristic of Adversary-in-the-Middle (AiTM) phishing attacks targeting modern authentication flows.
Detects usage of the 'One Outlook Web' application (ApplicationId 20893) to access Microsoft 365 Exchange REST APIs. This activity is a potential precursor to high-volume mailbox data exfiltration and should be monitored for volumetric anomalies.
Detects DNS resolution attempts for graph.microsoft.com by processes other than standard web browsers or mail clients. This activity is indicative of scripted tools or malicious software attempting to enumerate or access Microsoft 365 mailbox content via the Graph API, bypassing normal user interaction.
Detects a multi-stage sequence of network connections to Microsoft cloud services (login.microsoftonline.com, graph.microsoft.com, and data exfiltration endpoints like sharepoint.com) consistent with Storm-3121/Storm-3032 adversary activity. This rule is designed for IDS/IPS monitoring of traffic patterns indicating authentication, reconnaissance, and potential data exfiltration from Microsoft 365 environments.
Detects Microsoft Teams messages containing urgent language and themes related to passkey or SSO updates, which are indicative of a phishing attempt aimed at harvesting credentials or performing account takeover.
Detects high-volume file download or data access events across SharePoint, OneDrive, and Exchange Online. This rule monitors for requests from Python-based HTTP libraries (httpx, requests, urllib) targeting Microsoft Graph API endpoints, which is a pattern indicative of automated bulk data collection or exfiltration, often observed in campaigns like Storm-3121 or Storm-3032.
Detects evidence of an Adversary-in-the-Middle (AiTM) phishing attack where a user sign-in results in specific error codes (50074: MFA required; 50140: Keep-me-signed-in interrupted), followed by rapid enumeration of key M365 applications (OfficeHome, My Apps, My SignIns) using the same session/user-agent, signifying post-authentication reconnaissance via stolen tokens.
Detects internal Microsoft Teams messages containing lures related to passkey or SSO enrollment, which is indicative of a compromised account attempting to perform lateral phishing to harvest credentials or bypass multi-factor authentication.
Detects Microsoft Teams chat and message events originating from unverified or external tenants that attempt to impersonate internal IT helpdesk personas. This activity is often part of a multi-stage social engineering campaign, potentially following email bombing, where attackers aim to trick users into executing malicious files or installing remote access tools.
This rule detects references to specific social media handles and identifiers associated with the MEK/NCRI (National Council of Resistance of Iran) influence campaign within email URLs, device process command lines, and miscellaneous device events. It is designed to identify potential engagement with or dissemination of influence-related content on endpoints and in email communication.
This rule monitors Azure AD Sign-in logs to identify 'impossible travel' scenarios, where a user authenticates successfully from two geographically distant locations within a time window (1 hour) that would require travel speeds exceeding a plausible threshold. This behavior is a common indicator of credential compromise or session token replay attacks.
Detects instances where identified AI agents, bots, or automated assistants perform bulk access operations on mailboxes (e.g., MailItemsAccessed, Send, deletions) or data stores (e.g., FileDownloaded, FileAccessed, SearchQueryPerformed) in Microsoft 365 environments. This monitors for potentially compromised or malicious AI service accounts abusing legitimate access to harvest sensitive data.
Detects instances of OAuth device code flow authentication from suspicious sources (e.g., unfamiliar devices, non-compliant/unmanaged devices, or unusual geographic locations) that are followed closely by an OAuth application consent event. This behavior is indicative of potential consent phishing or device code phishing attacks attempting to gain persistent access to cloud resources.
This rule monitors Office 365 file download activity, identifying users whose download volume significantly deviates from their historical baseline. It specifically looks for an unusually high number of unique files downloaded in a one-hour window, while excluding known service accounts and synchronization agents like OneDrive sync client.
Detects anomalous sign-in behavior shortly after a successful MFA-authenticated session in Microsoft 365. This rule flags scenarios where a subsequent session for the same user occurs within a short window (30 minutes) from a different IP, ASN, User-Agent, or device identifier, potentially indicating the replay of a stolen session cookie obtained via Adversary-in-the-Middle (AiTM) phishing.
Detects high-risk account modifications, such as adding MFA methods or OAuth consent grants, occurring shortly after a user sign-in. This pattern is indicative of post-AiTM session theft (e.g., NovaCookies) where an adversary uses a stolen session token to modify account settings for persistence or MFA bypass.
Detects anomalous reuse of an authenticated Microsoft 365 session cookie shortly after a successful MFA-satisfied sign-in. The detection identifies scenarios where the subsequent access originates from a different IP address, device, or user agent without an intervening MFA challenge, which is a pattern indicative of session hijacking techniques like Adversary-in-the-Middle (AiTM) or session token replay.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Page 56 of 150