Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,936
7,266
6,535
3,866
3,647
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects inbound emails originating from a gmail.com sender that have not previously communicated with the recipient in the last 90 days. The rule identifies emails containing e-card or greeting card-themed subjects, which are often used as social engineering lures to masquerade as automated branded notifications for malicious activity or credential theft.
This detection looks for adversaries impersonating IT support or helpdesk via a Teams message.
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
Detects potential business email compromise or phishing attempts by identifying inbound emails that pass authentication checks but involve a first-time sender-recipient pair (no correspondence in 90 days) referencing financial themes such as invoices, bank accounts, or purchase orders.
Detects phishing attempts where the sender's display name implies a sensitive role (e.g., Accounts Payable, Helpdesk, Vendor) while the authenticated header-From domain utilizes a 'support' subdomain. The rule triggers when the organizational root domain extracted from the email sender address does not match the branding present in the sender display name, indicating potential brand impersonation or business email compromise.
This rule identifies potential account compromise or session hijacking by correlating anomalous outbound email patterns with risky sign-in events. It monitors for users who send outbound emails to a threshold of previously unseen external recipients within a short window after authenticating under suspicious conditions, such as high-risk sign-in flags, atypical locations, or unfamiliar applications. This pattern is indicative of attackers using stolen session tokens or compromised credentials to perform mass outbound phishing, spamming, or data exfiltration from an internal mailbox.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by correlating network events indicating a connection to a known phishing domain with subsequent suspicious authentication behavior. Specifically, it identifies sessions associated with non-corporate IP addresses that show evidence of token reuse (e.g., multiple distinct IP addresses for the same session identifier) occurring within a short window after accessing a phishing portal.
Detects interactive sign-in attempts for accounts commonly associated with Microsoft sync services (e.g., AD Connect, MSOL sync). Service accounts should typically perform background, non-interactive authentication. An interactive login for these accounts may indicate credential misuse or unauthorized access.
This rule detects potential mass data retrieval or excessive access to sensitive-labeled files by an individual user through Microsoft Copilot within a one-hour window. By monitoring the volume of distinct sensitivity-labeled objects accessed, it identifies behavior consistent with a user or compromised account performing high-volume information gathering.
Detects interactive sign-in attempts for accounts commonly associated with Microsoft sync services (e.g., AD Connect, MSOL sync). Service accounts should typically perform background, non-interactive authentication. An interactive login for these accounts may indicate credential misuse or unauthorized access.
This rule detects high-volume file access or download operations in SharePoint or OneDrive, performed by non-browser user agents (e.g., Python, PowerShell, cURL, Go). An elevated volume of such actions within a short timeframe is indicative of automated, scripted interaction, which may represent malicious data exfiltration, automated content scraping, or potential account compromise.
Detects the delivery of a malicious SVG data-URI payload targeting the CVE-2026-42897 vulnerability in Outlook Web Access (OWA). This exploit uses a base64-encoded SVG image embedded in an email body, which triggers an onload JavaScript handler when rendered by OWA, leading to potential code execution within the mailbox context.
This rule detects potential phishing emails that successfully pass through to the mailbox despite failing SPF, DKIM, or DMARC authentication checks. It specifically flags emails that claim to originate from high-value vendor domains (e.g., DocuSign, Zoom, Adobe, RingCentral) but contain links to external domains that do not match the alleged sender's domain, which is a common indicator of brand impersonation or credential harvesting campaigns.
Detects Microsoft 365 service principals using application-only (client-credentials) authentication to access the Microsoft Graph API, specifically targeting the calendarView endpoint of user mailboxes. This behavior matches the HOLLOWGRAPH attack technique, which leverages M365 calendars as a covert command-and-control (C2) channel.
Detects Office 365 calendar events created or modified with a specific far-future date (2050-05-13) or dates scheduled more than 10 years into the future. This behavior is associated with the HOLLOWGRAPH backdoor, which uses calendar items as a C2 channel to hide tasking or exfiltration events from the mailbox owner.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
Detects the creation of a new Service Principal followed by an immediate application of an app role assignment within one hour. The rule specifically targets service principals with names suggestive of automation, AI, or assistant-related roles (e.g., 'copilot', 'llm', 'bot'), which may indicate the use of newly created service principals for potential persistence or unauthorized access.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.
Page 82 of 150