Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
Detects high-frequency access requests to SharePoint or OneDrive services using the 'python-httpx' library. This behavior is indicative of automated scraping or mass data retrieval often associated with malicious actors or unauthorized automated tools.
Detects users accessing files across SharePoint, OneDrive, or Exchange over a sustained period of at least 6 hours, while maintaining a low-to-moderate frequency (1-999 events per hour). This behavioral pattern may indicate slow, automated data exfiltration or unauthorized reconnaissance of sensitive files while attempting to stay under traditional volume-based alerting thresholds.
This rule detects anomalous interaction with the Microsoft Graph API by monitoring for high-frequency requests across multiple functional categories (e.g., tenant, directory, privilege, application, repository, mailbox) from a single identity. A large number of distinct API paths across multiple categories in a short time frame is indicative of an attacker performing reconnaissance or automated environment enumeration.
Detects anomalous activity in Azure AD/Microsoft Graph API logs, where a specific user or application performs a high volume of requests across multiple sensitive administrative categories (such as directory roles, authentication methods, applications, and service principals) within a 30-minute window. This behavior is often indicative of reconnaissance or privilege escalation attempts by an adversary who has compromised an identity.
Detects internal phishing messages sent via Microsoft Teams that contain common credential-harvesting lures (e.g., passkey, MFA, SSO updates) where the sender account has also exhibited indicators of compromise within the preceding 24 hours, such as risky sign-ins or impossible travel.
Detects anomalous, high-frequency file access (100+ files within a 2-hour window) in Microsoft 365 (SharePoint or OneDrive) by users employing a Python-based HTTP client (python-httpx). This behavior is often indicative of automated data scraping, exfiltration, or bulk download activities performed by unauthorized scripts or compromised service accounts.
Detects specific authentication failure codes (50074, 50140) associated with MFA bypass and session persistence interruptions, which are characteristic of Adversary-in-the-Middle (AiTM) phishing attacks targeting modern authentication flows.
Detects file access or download operations performed by the python-httpx library within a specific cloud application context, which may indicate automated data retrieval or exfiltration attempts by scripts or custom tools.
This rule detects the addition of new multi-factor authentication (MFA) methods to an Azure AD or Entra ID user account. Adversaries often register new MFA methods (such as phone numbers or authenticator apps) to accounts they have compromised, enabling them to bypass existing MFA requirements and maintain persistent access to the target environment.
Detects usage of the 'One Outlook Web' application (ApplicationId 20893) to access Microsoft 365 Exchange REST APIs. This activity is a potential precursor to high-volume mailbox data exfiltration and should be monitored for volumetric anomalies.
Detects instances where a large volume of data (greater than 5GB) is transferred through an anonymous proxy using specific cloud application IDs. This pattern is indicative of potential data exfiltration via third-party or obscured network channels.
Detects DNS resolution attempts for graph.microsoft.com by processes other than standard web browsers or mail clients. This activity is indicative of scripted tools or malicious software attempting to enumerate or access Microsoft 365 mailbox content via the Graph API, bypassing normal user interaction.
Detects Microsoft Teams messages containing urgent language and themes related to passkey or SSO updates, which are indicative of a phishing attempt aimed at harvesting credentials or performing account takeover.
Detects high-volume file download or data access events across SharePoint, OneDrive, and Exchange Online. This rule monitors for requests from Python-based HTTP libraries (httpx, requests, urllib) targeting Microsoft Graph API endpoints, which is a pattern indicative of automated bulk data collection or exfiltration, often observed in campaigns like Storm-3121 or Storm-3032.
Detects user authentication events that exhibit patterns consistent with Adversary-in-the-Middle (AiTM) phishing campaigns, specifically those leveraging passkey or SSO-themed lures and device-code authentication flows.
Detects a sequence of user activities—authentication, MFA registration, Graph API reconnaissance, and data exfiltration—originating from a rotating set of distinct source IP addresses for the same user within a 24-hour period. This behavior is indicative of coordinated infrastructure rotation tactics used by threat actors in cloud intrusions.
Detects evidence of an Adversary-in-the-Middle (AiTM) phishing attack where a user sign-in results in specific error codes (50074: MFA required; 50140: Keep-me-signed-in interrupted), followed by rapid enumeration of key M365 applications (OfficeHome, My Apps, My SignIns) using the same session/user-agent, signifying post-authentication reconnaissance via stolen tokens.
Detects internal Microsoft Teams messages containing lures related to passkey or SSO enrollment, which is indicative of a compromised account attempting to perform lateral phishing to harvest credentials or bypass multi-factor authentication.
Detects Microsoft Teams chat and message events originating from unverified or external tenants that attempt to impersonate internal IT helpdesk personas. This activity is often part of a multi-stage social engineering campaign, potentially following email bombing, where attackers aim to trick users into executing malicious files or installing remote access tools.
Page 67 of 179