Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
Detects outbound network connections to identified infrastructure associated with 'Pink' (CL-CRI-1147) passkey-enrollment vishing campaigns. These operators use phone-based social engineering to direct victims to phishing domains that relay credentials and MFA tokens in real-time to register attacker-controlled passkeys. The rule monitors for specific DNS query patterns containing passkey-related keywords and known malicious IP addresses used by the threat group.
Detects instances where users click links directing to Proton Drive domains, a common vector for device code phishing and credential harvesting attacks.
Detects high-volume, anomalous authentication failure patterns originating from a single IP address, characterized by a large number of distinct applications and users accessed within a one-hour window. This is indicative of potential automated credential-based attacks such as password spraying or brute force.
Detects Microsoft Entra ID (formerly Azure AD) device registration, ownership assignment, or user assignment operations where the device display name matches a suspicious naming pattern, specifically 'GraphSpy-Device'. This naming convention is often associated with the GraphSpy tool, which is used by adversaries to enumerate and manipulate Entra ID resources, including registering rogue devices to bypass conditional access or MFA.
Detects high volumes of authentication failures (AADSTS50034) targeting non-existent or invalid usernames from a single source IP address, potentially indicating account enumeration or password spraying activity.
Detects login attempts using an Outlook/Office-specific User-Agent string where the application being accessed does not match common Microsoft 365 services (Outlook, Office, Exchange, Teams, OneDrive, SharePoint, ActiveSync, or Skype). This pattern is often indicative of programmatic attempts to bypass or spoof standard application signatures during credential stuffing or brute force campaigns.
Detects inbound or intra-organizational emails that contain URLs associated with Proton Drive services. This rule is specifically designed to identify potential device code phishing attempts or malicious document distribution utilizing Proton Drive's infrastructure.
This rule detects potential user enumeration attacks targeting Entra ID tenants by monitoring for failed sign-in attempts (ResultType 50034) involving common, predictable username patterns across multiple tenants within a 24-hour window. This behavior often indicates an adversary attempting to map valid usernames by exploiting error code differences or identity discovery patterns.
Detects Microsoft Entra ID sign-in events using the non-interactive OAuth device-code protocol against the 'common' tenant endpoint where MFA was not applied. This behavior is consistent with OAuth device-code phishing campaigns (e.g., Storm-2372/DEBULL) that exploit Conditional Access device-code flow allowances to bypass standard authentication controls.
Detects the presence of known ransomware extortion note file names on endpoints or communication attempts with associated extortion contact email addresses in email logs.
This rule identifies emails containing URLs that point to known malicious domains used in phishing campaigns. It joins email URL information with core email event details to report the sender, recipient, subject, and the specific malicious domain associated with the URL.
Detects instances where a user receives an email containing a link to 'canva.com' with subject lines suggestive of document sharing or invoicing, and subsequently clicks a URL that redirects them away from the 'canva.com' domain. This behavior is indicative of potential document-based phishing where attackers use legitimate document hosting platforms as a lure to redirect users to malicious or credential-harvesting websites.
Detects potential Resource Owner Password Credential (ROPC) password guessing attempts in Entra ID by monitoring for multiple AADSTS50126 (Invalid Username or Password) errors. Attackers may abuse ROPC to bypass multi-factor authentication requirements or perform brute-force attacks against cloud identities.
Detects the use of spoofed Exchange Online Application IDs in Azure sign-in logs. Attackers use these specific spoofed AppID patterns to bypass controls during Resource Owner Password Credential (ROPC) authentication, often for user enumeration purposes.
Detects anomalous authentication patterns originating from a single IP address where multiple users are targeted. The rule specifically monitors for a combination of error codes (50034 - User not found, 50126 - Invalid credentials, 700016 - Multi-factor authentication required) to identify potential password spraying or brute force activity targeting Microsoft Entra ID (formerly Azure AD).
Detects Microsoft Entra authentication events using the Resource Owner Password Credentials (ROPC) grant type where the User-Agent string explicitly identifies as a Microsoft Outlook desktop client. Adversaries often spoof these User-Agent strings in OAuth client ID campaigns to bypass conditional access policies or appear as legitimate traffic during automated login attempts.
This rule detects potential password spraying or brute-force activity by monitoring Azure Sign-in logs for a high volume of failed authentication attempts (error code 50126) originating from a single IP address across multiple distinct user accounts.
This rule detects incoming emails containing specific subject lines related to 'Request for Payment' and 'Shared Folder' that include links to the '/Team_Meets/' path. It flags instances where the sender's domain differs from the domain hosting the embedded link, which is a common indicator of phishing or credential harvesting attempts using domain masquerading.
Page 85 of 150