Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects attempts to disable audit logging features in Microsoft 365, specifically mailbox auditing (via Set-Mailbox) or unified audit log ingestion (via Set-AdminAuditLogConfig). Disabling these features can be a precursor to unauthorized activities, as it prevents the capture of user actions and administrative changes.
Detects high-volume, potentially programmatic search activity in Microsoft 365 SharePoint, characterized by iterative pagination requests using the 'indexdocid' parameter. This behavior may indicate an automated effort to crawl or systematically exfiltrate document metadata or content via the SharePoint search interface, often associated with post-exploitation discovery or unauthorized data collection.
Detects high-volume, potentially programmatic search activity in Microsoft 365 SharePoint, characterized by iterative pagination requests using the 'indexdocid' parameter. This behavior may indicate an automated effort to crawl or systematically exfiltrate document metadata or content via the SharePoint search interface, often associated with post-exploitation discovery or unauthorized data collection.
Detects anomalous, high-volume email access patterns (more than 200 mail items accessed per hour) by specific Client or Azure AD App IDs, which may indicate automated data collection or exfiltration by an adversary using compromised or unauthorized applications.
Detects anomalous, high-volume email access patterns (more than 200 mail items accessed per hour) by specific Client or Azure AD App IDs, which may indicate automated data collection or exfiltration by an adversary using compromised or unauthorized applications.
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
This rule identifies emails containing URLs associated with known suspicious or malicious domains (secboxes.com, msbenefit.com, attcdn.com, brianwilli.com). It filters for instances where the sender's domain is not one of the identified suspicious domains to reduce noise from potential email spoofing or miscategorized communications, flagging potential phishing attempts.
This rule detects potential indicators of compromise related to the 'ATodaPotencia' campaign by monitoring email URL logs, process command-line arguments, and general device events for the string 'ATodaPotencia'. The rule searches across multiple data sources to identify where this specific handle or artifact appears within an environment.
This rule detects activity matching known indicators of compromise (IOCs) associated with recent Russian espionage campaigns, including malicious domains, IP addresses, email senders, file names, and file hashes. It monitors network, sign-in, email, process, and file events across enterprise systems.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
This rule detects potential social engineering attacks where an attacker initiates a Microsoft Teams call from an external domain while impersonating an internal IT support or help desk entity. The detection specifically correlates this event with a recent preceding email bombing campaign (exceeding 20 emails) targeting the same user within the last 3 hours, indicating a coordinated attempt to pressure or confuse the victim.
Detects high-volume mailbox access (exceeding 50 items) performed by a specific API/Client ID pair associated with known mailbox exfiltration tools. This behavior is indicative of unauthorized automated data collection or harvesting from an Office 365 Exchange environment.
This rule monitors incoming emails by cross-referencing sender addresses against a hardcoded list of known malicious or suspicious email accounts. It associates these emails with any potential attachments to provide context for further investigation.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Page 61 of 179