Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
This rule detects potential Business Email Compromise (BEC) attempts where an attacker impersonates an executive (CEO, CFO, etc.) via email. It identifies emails where the Sender's display name suggests a high-level executive role, but the domain of the Reply-To address differs from the sender domain, which is a common indicator of a fraudulent routing attempt. The rule further narrows this down to emails with subject lines typical of financial-themed urgency or requests.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication methods policy where a new external authentication method is configured using a non-approved discovery URL. This could indicate an adversary attempting to configure a malicious identity provider to facilitate authentication bypass or unauthorized access.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication methods policy where a new external authentication method is configured using a non-approved discovery URL. This could indicate an adversary attempting to configure a malicious identity provider to facilitate authentication bypass or unauthorized access.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
This rule detects potential large-scale phishing campaigns by identifying email traffic patterns involving URLs hosted on the 'workers.dev' domain. It looks for a high volume of unique recipients and unique subject lines within a short timeframe, which is indicative of automated, mass-distributed phishing lures often used to evade traditional URL reputation filters.
This rule detects potential large-scale phishing campaigns by identifying email traffic patterns involving URLs hosted on the 'workers.dev' domain. It looks for a high volume of unique recipients and unique subject lines within a short timeframe, which is indicative of automated, mass-distributed phishing lures often used to evade traditional URL reputation filters.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects phishing emails that impersonate DocuSign by containing both an .ics calendar file attachment and a link directing users to the Microsoft login OAuth authorization endpoint, often indicative of credential or token harvesting.
Detects high-volume access to Microsoft Graph API endpoints related to messages, mail folders, and attachments by a single user account within a 30-minute window. This behavior is indicative of automated, unauthorized email and attachment scraping, often associated with remote email collection attempts.
Detects user account logins following a recent MFA registration (within 1 to 30 days) combined with subsequent network activity that utilizes node.js applications to query the Microsoft Graph API, which may indicate account takeover or malicious persistence setup.
This rule monitors email or communication logs for phishing lures themed around 'passkey' or 'sso' (Single Sign-On). It looks for indicators of urgency, helpdesk impersonation, or targeting of personal devices, which are often precursors to Adversary-in-the-Middle (AiTM) or device-code phishing attacks.
Detects when a user account updates their multi-factor authentication (MFA) details to include a higher count of registered devices than previously recorded. This behavior could indicate an attacker adding their own device to a compromised account to bypass MFA or maintain persistent access.
This rule detects successful authentication events for any user within the monitored environment. This serves as a foundational building block for detecting anomalous user behavior, particularly when combined with additional identity provider audit logs such as MFA method usage or registration timestamps to identify potential MFA bypass or persistence via newly registered MFA devices.
Detects anomalous activity in Microsoft Graph API logs where a single identity (user or application) performs a high volume of requests across multiple sensitive administrative categories, such as directory role management, authentication method modification, application or service principal changes, and OAuth consent operations. This pattern is indicative of potential unauthorized reconnaissance, privilege escalation, or persistence attempts within an Azure/Microsoft 365 environment.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous, high-volume access to Exchange Online via the REST API, potentially indicating programmatic exfiltration of email content. This rule monitors for specific suspicious Application IDs, Account Display Names, or Account Object IDs that exceed a threshold of 500 Exchange REST events, which is characteristic of mass-email collection patterns often seen in cloud-based identity compromises.
This rule monitors various logs (device network events, Entra ID sign-ins, cloud application events, and email events) for any interaction with a predefined list of indicator IP addresses identified as being associated with malicious actor egress traffic.
Page 58 of 179