Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,936
7,266
6,535
3,866
3,647
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects sign-ins from known UNC6671 residential-proxy IPs, ranked by rarity (first-seen for the user) and correlated with a following sensitive account action (MFA registration, mailbox rule change, admin role change).
This rule detects suspicious Microsoft Graph API activity involving the enumeration of user accounts within an organization. It specifically monitors for queries targeting personnel in sensitive roles such as payroll, finance, HR, and administration, as well as bulk enumeration attempts. The detection logic also flags usage of the axios HTTP library, a common tool in such reconnaissance campaigns, and aggregates results by source IP/ASN to identify coordinated efforts, such as those associated with the Storm-2755 threat actor.
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Detects bulk SharePoint/M365 file access or download either from a known UNC6671 exfiltration IP, or via a scripting-library user agent that is new for the user and exceeds a volume threshold within a short session window.
Detects anomalous mailbox activity in Microsoft 365 where a user account performs both search operations and mail item access, particularly when the activity originates from multiple IP addresses or exceeds a threshold of mail items accessed within a one-hour window. This behavior often indicates potential mailbox compromise or unauthorized data collection.
Detects a password reset followed by the deletion of two or more verified security-notification emails (matched to actual notification sender domains) within 24 hours, prioritizing permanent deletions as higher-confidence evidence-destruction behavior.
Detects the creation of a new inbox rule that performs email manipulation actions (forward, redirect, delete, move, or stop processing) shortly after a user account has logged in with a high or medium risk score, or an unusual result type. This pattern is commonly indicative of account compromise where an attacker establishes persistence or data exfiltration via mailbox rules.
Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.
Detects OAuth applications receiving permissions to the tenant, used for persistence and data theft. A consented app holds its own token and survives password resets and MFA, which is why consent phishing and post-compromise app registration are favored by both commodity BEC actors and nation-state (PerfectData is linked to Midnight Blizzard / APT29). Tiered: a hardcoded list of known-abused app IDs (PerfectData, eM Client, rclone, Supermailer, and others), layered over a scope-characteristic tier that catches bespoke apps by the permissions they request (Mail/EWS, Files/Sites, Directory, Application, offline_access), with admin/AllPrincipals consent escalating blast radius. Parses all three consent event shapes and resolves app identity across them.
This rule detects anomalous, high-volume file access activity within SharePoint by monitoring the 'FileAccessed' operation. It calculates a 14-day rolling baseline for each user and triggers an alert when the hourly 'FileAccessed' count significantly exceeds this baseline, specifically when no corresponding 'FileDownloaded' events are present. This behavior aims to detect stream-based data exfiltration techniques that bypass standard download-based DLP controls.
This rule detects potentially malicious activity where an attacker, having performed a password reset or MFA change on a compromised account, attempts to hide their tracks by rapidly deleting security-related notification emails (e.g., password reset alerts) shortly after they arrive in the user's mailbox. It correlates Exchange mailbox operations with audit log account security changes to filter out routine noise.
Detects non-interactive sign-ins (refresh-token usage) for Microsoft Purview Communication Compliance reviewer accounts (Administrator, Analyst, or Investigator roles) that originate from IP addresses not observed for the user in the previous 21 days. This behavior is indicative of potential token theft or session hijacking attempting to bypass multi-factor authentication.
Detects anomalous spikes in per-user M365 (SharePoint and Exchange) activity volume by comparing current 15-minute intervals against a 30-day rolling baseline (mean + 3 standard deviations). This behavior may indicate mass data staging or exfiltration activities common in precursor phases of extortion or data theft.
This rule detects high-volume file access or download operations in SharePoint or OneDrive, performed by non-browser user agents (e.g., Python, PowerShell, cURL, Go). An elevated volume of such actions within a short timeframe is indicative of automated, scripted interaction, which may represent malicious data exfiltration, automated content scraping, or potential account compromise.
This rule detects potential mass data retrieval or excessive access to sensitive-labeled files by an individual user through Microsoft Copilot within a one-hour window. By monitoring the volume of distinct sensitivity-labeled objects accessed, it identifies behavior consistent with a user or compromised account performing high-volume information gathering.
This rule detects potential data exfiltration via email by identifying mass near-identical background-image URLs in the body of an email. The rule looks for a high volume (8+) of distinct URLs that contain short parameters (indicative of encoded or smuggled data) within a single email. It further refines the detection by checking for the presence of specific CSS-like syntax often used in CSS-injection keylogging techniques to force the browser or email client to send background-image requests.
This rule monitors web browser URL click events for specific patterns (createssopasskey, addssopasskey) often used in vishing-lure campaigns. It identifies potential Adversary-in-the-Middle (AiTM) credential harvesting attempts by cross-referencing clicked URLs against an organization's approved SSO domain allowlist and verifying the presence of an internal referrer in the redirect chain. If a user clicks a suspect link that does not originate from a known internal source and points to an unauthorized external domain, the event is flagged.
Detects a sudden spike in subscription/confirmation-themed emails to a single recipient within a 10-minute window, significantly exceeding that recipient's historical baseline, excluding properly authenticated reputable bulk senders. This pattern is consistent with 'email bombing' used by UNC6692 to overwhelm targets before follow-up vishing/Teams-based IT impersonation social engineering.
Detects non-interactive sign-ins (refresh-token usage) for Microsoft Purview Communication Compliance reviewer accounts (Administrator, Analyst, or Investigator roles) that originate from IP addresses not observed for the user in the previous 21 days. This behavior is indicative of potential token theft or session hijacking attempting to bypass multi-factor authentication.
This rule detects 'impossible travel' activity performed by users assigned to sensitive Microsoft 365 Communication Compliance roles. It monitors Azure Sign-in logs for successful authentication events occurring within a short timeframe (1 hour) from multiple distinct geographic locations (countries) or different autonomous system numbers (ASNs). This behavior is characteristic of an adversary utilizing stolen session tokens or compromised credentials to access protected administrative functions.
Detects SharePoint Online search queries involving sensitive keywords related to M&A, legal, or financial activities, excluding authorized personnel in departments such as legal or finance. This rule helps identify potential unauthorized internal reconnaissance or data staging activities within an organization's document management system.
Page 80 of 150