Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,936
7,266
6,535
3,866
3,647
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects forged NDA documents used in Phantom Deal M&A fraud campaign, requiring co-occurrence of impersonated advisory firm branding, secrecy-clause language restricting communication to personal channels, and M&A-fraud-specific wire/payment indicators rather than secrecy-clause phrasing alone
This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
Detects anomalous email access patterns across multiple mailboxes using specific application identifiers or access contexts often associated with automated collection tools. This rule flags when an application accesses more than 20 items across distinct mailboxes in a 15-minute window, which is indicative of potential unauthorized bulk email collection or data exfiltration.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects successful Azure AD sign-ins where the user agent identifies as a Python requests library version (2.33.1 or 2.34.2) that has not been observed for that specific user account in the preceding 14 days. This behavior is indicative of anomalous automated or scripted access.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects cloud application events originating from suspicious or specific User-Agent strings, including 'python-requests' and identified outdated or potentially spoofed Chrome versions (146, 150, 151.0.0). This behavior often correlates with automated scripts or bot activity interacting with cloud services.
Detects cloud application events originating from suspicious or specific User-Agent strings, including 'python-requests' and identified outdated or potentially spoofed Chrome versions (146, 150, 151.0.0). This behavior often correlates with automated scripts or bot activity interacting with cloud services.
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects high-frequency access to mail items or attachments using specific One Outlook Web Client AppIDs. This behavior may indicate automated mailbox harvesting or unauthorized bulk data access via an atypical API path.
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule detects potential phishing activity by correlating email delivery events and URL click events against a set of known malicious domains and suspicious URL paths. It identifies when a user receives an email containing a suspicious link or interacts with such a link, providing visibility into potential credential harvesting or malware delivery attempts.
Page 74 of 150