Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,936
7,266
6,537
3,866
3,647
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule correlates Microsoft Defender for Office 365 'Safe Links' phishing alerts, which indicate a user has clicked a potentially malicious URL. It extracts the malicious domain from the URL and aggregates multiple alert events by that domain to identify potential phishing campaigns impacting multiple users within the organization.
Detects Microsoft Teams messages containing specific external domains, which may indicate phishing or unauthorized sharing of malicious links within the organization.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
This rule detects potential phishing activity by identifying bulk email campaigns (5 or more recipients) where either the email subject contains known suspicious keywords (e.g., 'password', 'urgent', 'invoice') or the Reply-To address domain differs from the sender domain. The rule specifically excludes emails with attachments or URLs, focusing on social engineering pretexts that aim to initiate a conversation or gather information without external payloads.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
This rule detects potential session token replay attacks in Azure Active Directory by correlating interactive or single-factor sign-in events using 'python-requests' user agents (common in automated tooling) with subsequent 'Register device' and 'Register security info' (Windows Hello for Business) activity within a 48-hour window. This behavior often indicates an adversary attempting to register a device to a compromised account to maintain persistence or bypass MFA requirements.
Correlates email delivery, URL click telemetry, endpoint network connections, and process execution evidence for one or more suspicious URLs or domains.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
Detects the creation or modification of inbox rules in Office 365 that involve automatic email forwarding, redirection, or deletion. Such rules are commonly created by adversaries to exfiltrate email data or maintain persistent access to a compromised mailbox.
Identifies potentially suspicious email forwarding configurations, mailbox permission assignments, transport rule changes, and delegate access grants that could enable unauthorized email access or data exfiltration.
The query correlates multiple Microsoft 365 audit activities including:
Inbox forwarding rules
SMTP mailbox forwarding
Transport rule forwarding
Delegate mailbox access assignments
Removed or disabled forwarding configurations
This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
The query correlates multiple Microsoft 365 audit activities including:
Inbox forwarding rules
SMTP mailbox forwarding
Transport rule forwarding
Delegate mailbox access assignments
Removed or disabled forwarding configurations
This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
This rule monitors for incoming emails containing suspicious attachments (such as .htm, .xhtml, .svg, or QR codes) associated with common business-related subject lines or file names (e.g., 'contract', 'agreement', 'edocs'). It specifically identifies emails originating from 'amazonses.com' that do not match expected trusted domains like DocuSign or Workday, indicating a potential credential harvesting or phishing attempt.
This rule monitors Microsoft Teams communication logs to identify messages containing URLs. By parsing the message content and extracting domains, this rule facilitates the detection of potentially malicious links, phishing attempts, or unauthorized data sharing within the organization's Teams environment.
Detects instances where Microsoft Teams logs report a message containing a 'Malicious url'. This suggests a potential phishing attempt via Teams, where a user is being sent a link classified as malicious by security systems.
Detects session hijacking activity characteristic of the Mirage2FA AiTM (Adversary-in-the-Middle) phishing toolkit. The rule identifies non-interactive authentication events (token reuse) that lack an MFA challenge, occurring shortly after interaction with a known malicious phishing proxy domain. It further correlates this activity with anomalous signals, such as impossible travel or the use of an unseen device/user-agent, to confirm high-fidelity malicious intent.
Detects Microsoft Copilot interaction URLs containing the 'autorun=1' parameter alongside a 'q=' prompt parameter. This combination indicates a potential attempt to execute a prompt in the user's Copilot session without explicit user confirmation upon link click, a technique sometimes referred to as a CoSnitch or one-click attack.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Detects Microsoft Copilot interaction URLs containing the 'autorun=1' parameter alongside a 'q=' prompt parameter. This combination indicates a potential attempt to execute a prompt in the user's Copilot session without explicit user confirmation upon link click, a technique sometimes referred to as a CoSnitch or one-click attack.
Inbound email campaigns containing links to external personal SharePoint sites (*-my.sharepoint.com) sent to multiple recipients.
This rule monitors outbound email traffic per sender and flags accounts exceeding a specified hourly threshold. A sudden spike in outbound emails from a single user account may indicate a compromised mailbox being used for spam, phishing, or mass data exfiltration.
Detects modifications, registrations, or deletions of security information for a user account, or general management updates within the user directory, which may indicate account tampering or unauthorized privilege persistence.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
Page 78 of 150