Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects high-volume or large-size file access, download, or preview activity originating from known anonymous proxy IP addresses. This behavior is indicative of potential data exfiltration or unauthorized scraping of sensitive documents from cloud storage.
This rule detects anomalous, high-volume file and email access events by a single user from a single IP address within the Microsoft 365 environment. The detection logic groups operations such as file downloads, file access, and mailbox item access, flagging instances where a user performs 100 or more such operations, which may indicate data exfiltration or compromised account activity.
This rule detects potential adversary-in-the-middle (AiTM) or device-code authentication attacks where a user reports suspicious vishing (voice phishing) or SMS lures involving passkeys or SSO updates. The rule correlates user-reported social engineering pretexts with evidence of risky authentication flows, such as device code usage or specific authentication error codes associated with interception.
This rule detects high-volume email bursts sent through third-party bulk email providers where the sender domain exhibits SPF, DKIM, or DMARC alignment failures. This behavior is indicative of mass phishing campaigns, such as those associated with 'Operation DoppelBrand', attempting to bypass email authentication defenses using compromised or unauthorized infrastructure.
Detects high-volume deletion or recycling of files within OneDrive or SharePoint for a specific user, which may indicate malicious activity such as data destruction, ransomware, or unauthorized data exfiltration staging.
Detects bulk file deletion activities (three or more files deleted or moved to the recycle bin) within SharePoint or OneDrive by a specific user within a 30-minute window, which may indicate malicious activity or data destruction.
Detects inbound emails impersonating IT support or helpdesk staff that utilize urgent pretexts related to passkey, MFA, or SSO updates. These lures are commonly used in phishing campaigns to direct users toward malicious authentication flows, such as AiTM or device-code phishing setups.
Detects high-volume, automated file download or access activity originating from SharePoint Online, OneDrive, or Exchange Online within a 2-hour window. The rule identifies suspicious patterns involving a large number of distinct file events, potentially indicating automated scripts or tools (like python-httpx) performing mass data collection or exfiltration.
Detects high-volume, automated file download or access activity originating from SharePoint Online, OneDrive, or Exchange Online within a 2-hour window. The rule identifies suspicious patterns involving a large number of distinct file events, potentially indicating automated scripts or tools (like python-httpx) performing mass data collection or exfiltration.
Detects a single user account sending an unusually high volume of Microsoft Teams messages containing themes related to passkey, SSO enrollment, or security updates. This behavior is indicative of a compromised internal account being leveraged to propagate social engineering lures to other employees.
This rule detects potential identity compromise via abuse of the OAuth device-code grant flow. It monitors for successful user logins leveraging the device code flow, which is a common indicator of AiTM (Adversary-in-the-Middle) phishing campaigns that lure users into authorizing malicious applications under pretexts like security updates or SSO re-authentication.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
Detects anomalous, systematic enumeration of multiple Microsoft Graph API resource categories (e.g., users, groups, applications, sites) by a single identity, IP, or application within a short time window. This activity often indicates an adversary performing discovery or reconnaissance against the M365 tenant environment.
Detects anomalous, high-volume file access or download activity in Microsoft SharePoint Online or OneDrive for Business originating from a 'python-httpx' user agent. This pattern often indicates automated data collection or exfiltration attempts using programmatic tools.
Detects anomalous, low-volume data access behavior within cloud applications (such as file downloads, previews, or mail access) that is sustained over an extended period. This pattern often indicates slow, deliberate data exfiltration designed to evade volume-based detection thresholds.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
This rule detects device registration, joining, or enrollment events where the DeviceDisplayName follows a specific naming pattern (e.g., 'word-word-alphanumeric-word-hash'). It groups these events by device and user to track frequency, which can help identify potentially automated or malicious device registration behavior.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Page 63 of 179