Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,936
7,266
6,535
3,866
3,647
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule monitors Microsoft 365 SharePoint and OneDrive audit logs for the 'SharingSet' operation to detect when internal items are shared with external guests. It classifies sharing events based on permission level and site type (Personal vs. SharePoint site) to highlight potentially high-risk external collaboration.
Provides a consolidated view of email metadata, delivery outcomes, attachments, embedded URLs, sender infrastructure, and security verdicts for inbound and outbound email investigations.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
Detects inbound emails containing password-protected archives (rar, zip, 7z) from either common freemail providers or domains matching known social engineering themes (e.g., webinar, interview, research). The rule specifically flags emails where the subject or body includes password hints (e.g., 'pwd', 'extract', 'unzip') indicating an attempt to deliver malicious payloads while evading email gateway inspection.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
Aggregates identity, endpoint, cloud application, and messaging telemetry to build a consolidated profile of the devices, clients, applications, and user agents associated with a specific user account.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
Identifies suspicious inbound bulk email campaigns by correlating sender behaviour, recipient spread, URL evidence, Safe Links click telemetry, external SharePoint links, post-delivery remediation actions, and campaign delivery outcomes.
The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions.
It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction.
Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions.
It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction.
Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
Detects network traffic indicating potential Command and Control (C2) tasking communication via Microsoft SharePoint. The rule monitors for requests to specific SharePoint paths associated with the TWINLOOT campaign, which leverages legitimate cloud infrastructure for malicious command delivery.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Detects Microsoft Entra ID Protection risk telemetry for sign-ins with unfamiliar properties. Microsoft evaluates characteristics such as ASN, browser, device, and location against the user's historical behavior to identify anomalous sign-ins that may warrant investigation.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
This rule detects potential spearphishing attempts by identifying emails with ZIP attachments that contain filenames or subjects masquerading as specific organizations or job opportunities (e.g., 'Lockheed Martin', 'Enveil'). It triggers on incoming emails containing suspicious job-lure keywords in the subject line or file attachments, which are often used to deliver initial access payloads.
Detects unauthenticated WordPress administrator account takeover attempts targeting the User Profile Builder plugin. The rule identifies inbound HTTP GET requests containing the 'autologin=true' parameter and a forged '_wpnonce' value matching the 'autologin-1-' pattern, which exploits an authentication bypass vulnerability (CVE-2026-15826) to gain unauthorized session access as user ID 1.
This rule detects email communications where the subject line contains numerical patterns matching standard credit card number formats (13-16 digits, or spaced/hyphenated variations). The purpose is to identify potential unauthorized transmission of sensitive financial data (PII/payment information) via email.
Identifies inbound email campaigns that deliver URLs to large numbers of recipients and groups activity by parent domain.
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
Detects anomalous mailbox access via the MailItemsAccessed operation, specifically identifying the unique ClientAppId and API pairing associated with the Storm-2755 (Payroll Pirates) adversary campaign. This activity indicates unauthorized access to email content, typically targeting high-value personnel such as payroll, finance, and HR staff through Adversary-in-the-Middle (AiTM) techniques.
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
Detects inbound email messages authenticated with an amazonses.com DKIM signature that originate from a specific Amazon SES Tokyo-region relay IP address. This may indicate an adversary is leveraging a compromised or unauthorized transactional email account (e.g., SES or third-party platforms like Resend) to send emails on behalf of a victim domain.
This rule detects potentially malicious mailbox search and item access activity in Microsoft 365. It monitors for users who trigger both 'Search' and 'MailItemsAccessed' actions within a one-hour window. The detection logic flags behavior that includes a high volume of mail access (more than 10 events) or access originating from multiple distinct IP addresses, which are common indicators of automated collection or credential compromise.
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
This rule detects Azure AD sign-in attempts to the 'OfficeHome' application resulting in error code 90014. This specific error indicates that the OAuth flow was initiated without the required nonce parameter, a behavior frequently observed when adversary-in-the-middle (AiTM) phishing kits relay authentication flows incorrectly. The rule highlights the significance of this error when correlated with implausible user-agent and operating system combinations.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
Page 79 of 150