Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects phishing emails that impersonate DocuSign by containing both an .ics calendar file attachment and a link directing users to the Microsoft login OAuth authorization endpoint, often indicative of credential or token harvesting.
This rule monitors network, DNS, and email activity to identify communication or references to a set of known malicious domains associated with threat activity. It consolidates logs from device network events, DNS queries, and email telemetry (URLs and sender domains) to detect potential compromise or phishing attempts.
Detects phishing emails containing URLs with IPv6-mapped IPv4 addresses (e.g., [::ffff:192.168.0.1]). Adversaries use this obfuscation technique to bypass security filters that may not correctly parse or normalize IPv6-mapped addresses within URLs.
This rule monitors network, DNS, and email activity to identify communication or references to a set of known malicious domains associated with threat activity. It consolidates logs from device network events, DNS queries, and email telemetry (URLs and sender domains) to detect potential compromise or phishing attempts.
Detects incoming emails from specific suspicious domains that pass authentication checks (SPF, DKIM, DMARC) but contain subject lines commonly associated with phishing campaigns, such as invoices, payment requests, or urgent notifications. The rule includes associated URL and attachment information for further analysis.
Detects successful post-delivery email remediation actions (such as ZAP, manual deletion, or moving to junk) performed on emails associated with the Operation DoppelBrand campaign, identified by specific sender domains (service-nowinc.com, domainlify.net) or suspicious invoice-fraud subject lines.
Detects inbound emails that spoof ServiceNow branding or impersonate high-level organizational roles (e.g., CEO, VP, President) in the display name while using common reply/forward subject headers. The rule specifically flags these if the sender domain does not originate from a legitimate service-now.com domain and contains PDF or HTML attachments, which are common vectors for credential harvesting or malware delivery.
This rule detects potentially malicious OAuth application consent grants in Microsoft Entra ID (formerly Azure AD). It monitors for consent events involving high-risk scopes by non-verified publishers, instances of admins attempting to bypass consent requirements, and follows up by checking for unusually high activity (sign-ins or resource access) from the newly consented application within a short timeframe.
This rule monitors for Exchange administration operations where mailbox permissions ('FullAccess', 'SendAs', or 'SendOnBehalf') are granted to a user. It specifically flags instances where the account performing the action is neither the owner of the target mailbox nor the grantee, identifying suspicious, potentially unauthorized delegation patterns.
Detects the creation or modification of Power Automate flows that involve potentially sensitive external services or personal email providers, which may indicate data exfiltration or unauthorized integration setup.
Detects inbound emails that pass SPF, DKIM, and DMARC authentication checks but contain attachments (PDF, HTML, DOCX, XLSX, SVG) with subjects commonly used in phishing lures such as DocuSign, shared documents, invoices, or HR announcements.
This rule detects potential large-scale phishing campaigns by identifying email traffic patterns involving URLs hosted on the 'workers.dev' domain. It looks for a high volume of unique recipients and unique subject lines within a short timeframe, which is indicative of automated, mass-distributed phishing lures often used to evade traditional URL reputation filters.
Detects anomalous, high-frequency mailbox search and access activity targeting financial-related keywords (e.g., invoices, wire transfers, bank details). This behavior pattern is frequently observed during business email compromise (BEC) attacks, where adversaries utilize OAuth tokens to triage mailboxes for sensitive payment information.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
This rule monitors Microsoft Graph API audit logs for suspicious patterns indicative of automated discovery or enumeration of SharePoint and OneDrive environments. It detects high-frequency access to sensitive API endpoints (such as /sites, /drives, or /children) and the use of pagination parameters (skiptoken, top) within short time intervals, which are common techniques used to crawl and inventory organizational data at scale.
This rule monitors Microsoft Graph API audit logs for suspicious patterns indicative of automated discovery or enumeration of SharePoint and OneDrive environments. It detects high-frequency access to sensitive API endpoints (such as /sites, /drives, or /children) and the use of pagination parameters (skiptoken, top) within short time intervals, which are common techniques used to crawl and inventory organizational data at scale.
Detects anomalous high-volume access to Exchange Online via the One Outlook Web/Office client, potentially indicating data exfiltration or automated mass email access by a compromised account.
Page 69 of 179