Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,934
7,265
6,535
3,865
3,645
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, non-interactive sign-in activity in Microsoft 365 that suggests session cookie replay (Pass-the-Cookie). The rule correlates successful, MFA-validated interactive sign-ins against subsequent, non-interactive sign-ins that lack MFA, occur from a different device and IP address within a short time window, and bypass standard interactive re-authentication.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
This rule detects high-volume email bursts sent through third-party bulk email providers where the sender domain exhibits SPF, DKIM, or DMARC alignment failures. This behavior is indicative of mass phishing campaigns, such as those associated with 'Operation DoppelBrand', attempting to bypass email authentication defenses using compromised or unauthorized infrastructure.
Detects coordinated email phishing campaigns by normalizing email subjects to identify recurring templates and flagging those sent to a high volume of recipients across multiple organizations within a short timeframe. The rule specifically targets financial and urgent pretexts from external senders, similar to observed techniques in impersonation campaigns.
Detects incoming or outgoing emails with subject lines containing keywords associated with extortion, data leaks, or data breaches, specifically when accompanied by email attachments.
Detects the creation of an inbox rule in Microsoft 365 that includes common financial terms ('invoice', 'payment', 'wire', 'transfer') and utilizes email forwarding ('ForwardTo' or 'RedirectTo'). This pattern is highly indicative of Business Email Compromise (BEC) attempts, where an attacker intercepts financial correspondence.
Detects the creation of an inbox rule in Microsoft 365 occurring shortly after a user's mailbox items were accessed. This pattern is often indicative of account compromise where an adversary accesses a mailbox to identify sensitive information and subsequently creates inbox rules (e.g., to redirect or delete emails) to maintain persistence or conceal their activity.
Detects phishing emails that impersonate DocuSign by containing both an .ics calendar file attachment and a link directing users to the Microsoft login OAuth authorization endpoint, often indicative of credential or token harvesting.
Detects phishing emails that impersonate DocuSign by containing both an .ics calendar file attachment and a link directing users to the Microsoft login OAuth authorization endpoint, often indicative of credential or token harvesting.
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
Detects incoming emails containing invisible Unicode tag characters used to obfuscate keywords and bypass spam filtering and AI-based detection mechanisms.
Detects incoming emails to finance or accounts payable aliases that contain urgent payment-related keywords and suspicious patterns, such as subject lines including dollar amounts or emails where the Reply-To address domain differs from the Sender domain. This activity is highly indicative of BEC fraud attempts targeting payment redirection.
Detects incoming emails to finance or accounts payable aliases that contain urgent payment-related keywords and suspicious patterns, such as subject lines including dollar amounts or emails where the Reply-To address domain differs from the Sender domain. This activity is highly indicative of BEC fraud attempts targeting payment redirection.
Detects incoming emails to finance or accounts payable aliases that contain urgent payment-related keywords and suspicious patterns, such as subject lines including dollar amounts or emails where the Reply-To address domain differs from the Sender domain. This activity is highly indicative of BEC fraud attempts targeting payment redirection.
Detects coordinated email phishing campaigns by normalizing email subjects to identify recurring templates and flagging those sent to a high volume of recipients across multiple organizations within a short timeframe. The rule specifically targets financial and urgent pretexts from external senders, similar to observed techniques in impersonation campaigns.
Detects inbound emails that spoof ServiceNow branding or impersonate high-level organizational roles (e.g., CEO, VP, President) in the display name while using common reply/forward subject headers. The rule specifically flags these if the sender domain does not originate from a legitimate service-now.com domain and contains PDF or HTML attachments, which are common vectors for credential harvesting or malware delivery.
Detects inbound emails from external domains containing keywords related to financial transactions or urgency in the subject line (specifically matching forwarded or reply formats) accompanied by PDF or HTML attachments. This heuristic approach attempts to identify potential business email compromise (BEC) or phishing lures mimicking invoices or approval requests in environments where raw email body content is unavailable.
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Page 66 of 150