Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects network connection events involving a specific known malicious IP address (5.230.71.51) identified as participating in unauthorized Intune enrollment or Entra ID device registration processes.
This rule detects anomalous behavior where a single user account registers multiple devices within a very short timeframe (80 seconds). This pattern often follows the theft of a device code or OAuth authorization token, where an adversary attempts to rapidly enroll multiple rogue devices to maintain persistent access or bypass MFA controls.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
This rule detects successful authentication events using the Microsoft OAuth device code flow, which is often abused in phishing campaigns to hijack user sessions. It flags authentication attempts that match specific device authorization URLs, include signs of bypassing security warnings, or indicate a lack of direct user authentication interaction.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects successful modifications to user MFA methods (StrongAuthenticationMethod) where the associated device details are missing or indicate a software-only token activation. This behavior is often indicative of an adversary adding their own MFA device to a compromised account to maintain persistent access or bypass MFA requirements.
Detects high-volume, sustained or burst-like access, download, or deletion activity by a single user across SharePoint, OneDrive, or Exchange services. This behavior is indicative of potential data staging, exfiltration, or bulk malicious activity by a compromised account or insider.
This rule detects potential reconnaissance activity against Microsoft Graph API endpoints, indicative of an adversary enumerating tenant resources such as users, groups, applications, and directory roles. It monitors for high volumes of diverse Graph API queries originating from a single user or application identity within a short time window, which is a common behavior pattern for automated discovery tools.
This rule monitors cloud and identity logs to detect a single user identity exhibiting multiple stages of suspicious activity (authentication, reconnaissance, and exfiltration) within a 24-hour period while utilizing distinct, non-overlapping source IP addresses for each stage. This behavior is indicative of an account compromise where different stages of the attack chain originate from different infrastructure.
Detects instances where a user account experiences an 'Unusual sign-in' event followed by the registration of a new MFA or security information method within a one-hour window. This behavior is indicative of an attacker attempting to establish persistent access by registering their own authentication device to a compromised account.
Detects anomalous, high-volume mailbox access across multiple distinct Exchange Online mailboxes within a short timeframe (1 hour) initiated by a single user account. This behavior is indicative of automated email reconnaissance, content scraping, or bulk exfiltration, often associated with post-credential compromise activity where an attacker iterates through mailboxes to identify sensitive information such as financial or administrative data.
Detects high-volume, automated Pix transfer transactions within a short timeframe from a single source or session, which may indicate unauthorized use of a 'Pix' panel or automated financial fraud.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
This rule detects high-volume, burst-pattern email distribution associated with a 'New VM Received' subject line, originating from non-authorized or non-corporate domains. This behavior is indicative of potential mass phishing or spam campaigns mimicking automated voicemail notifications.
Detects anomalous activity where AI-enabled browser agents or extensions perform email summarization or access actions without corresponding user UI interaction, subsequently sending or sharing the information to an external recipient address distinct from the mailbox owner.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
This rule monitors for a multi-stage attack pattern involving two potential indicators: first, it identifies phishing emails containing a 'Google Docs' link combined with an attachment named 'API Logic Flaw'. Second, it detects browser activity involving the paste of JavaScript code or suspicious browser clipboard activity, which may indicate an attacker attempting to execute malicious scripts directly in the user's browser context.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
Detects phishing emails containing URLs with IPv6-mapped IPv4 addresses (e.g., [::ffff:192.168.0.1]). Adversaries use this obfuscation technique to bypass security filters that may not correctly parse or normalize IPv6-mapped addresses within URLs.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
Page 60 of 179