Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,934
7,265
6,535
3,866
3,645
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects potential Microsoft Teams impersonation or social-engineering activity where accounts use IT, admin, support, or security-themed display names, especially when associated with external users or impersonation indicators.
Detects sign-in activity in Entra ID where the application display name is blank, despite an Application ID being present, originating from known cloud service provider IP ranges (AWS or Cloudflare). This pattern is consistent with automated enumeration or discovery tools that leverage OAuth client ID spoofing or misconfigurations to identify valid tenants or users.
Detects inbound emails with document-related subjects that contain links to the systeme.io platform, which are subsequently clicked and redirected to a different destination. This pattern is commonly used in phishing campaigns to bypass initial security inspection by leveraging reputable hosting platforms as a redirector.
Correlates a Microsoft 365 OAuth device-code authentication event with subsequent impact actions on the same identity (device registration/PRT setup, inbox rule creation, or PRT/sign-in activity after a password reset) within a 1-hour window. Severity escalates as more distinct impact phases co-occur on the same actor, consistent with ARToken/EvilTokens post-device-code-phishing persistence chains.
This rule detects successful sign-in events originating from IP addresses that have previously demonstrated a password-spraying pattern (multiple failed sign-ins across distinct accounts within a two-hour window). To reduce noise, it excludes successful logins originating from 'known' Autonomous System Numbers (ASNs) where at least 10 distinct users have historically authenticated successfully. The detection further filters for sessions lacking managed device identifiers and allows for manual exclusion of specific applications, IP addresses, or geographic locations.
Detects Microsoft Graph API requests that query directory role assignments specifically looking for highly privileged roles such as Global Administrator, Exchange Administrator, or Security Administrator. This activity may indicate an adversary is enumerating privileged roles to identify potential targets for privilege escalation or lateral movement within an Azure/Microsoft 365 environment.
Detects spearphishing emails that contain both a link to the legitimate 'microsoft.com/devicelogin' page and the phrase 'device code'. This is a common social engineering tactic used to trick users into providing a device authorization code to an attacker, enabling them to bypass MFA and hijack user sessions via OAuth device code flow.
Detects failed authentication attempts using the BAV2ROPC user agent (Azure CLI / legacy OAuth2 ROPC token requests) in Microsoft 365 Unified Audit Logs. BAV2ROPC bypasses MFA by authenticating directly to the /token endpoint. Error codes 50053 (account lockout), 50126 (invalid credentials), and 50034 (user not found) are characteristic of password spraying activity. Observed in the LSHIY LLC password spray campaign (June 2026).
Detects incoming emails identified as phishing attempts by matching specific sender addresses, subjects related to freight/logistics, or embedded URLs and keywords associated with the 'signindat.com' domain.
This rule detects Microsoft Teams activities such as ChatCreated, MessageSent, or TeamsImpersonationDetected where the sender's display name matches common administrative or support-themed identifiers (e.g., 'IT Support', 'Help Desk', 'Global Admin'). This behavior is commonly associated with social engineering and phishing attempts designed to trick users into divulging credentials or sensitive information by masquerading as trusted enterprise support roles.
Detects high volumes of file download operations from OneDrive or SharePoint occurring within one hour of a device-code authentication event. This pattern is indicative of potential data exfiltration by an adversary using a stolen access token obtained via an OAuth device-code phishing attack.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
This rule detects potentially malicious email activity that uses recruitment or career-related pretexts to target specific organizations (Boeing, Airbus, Teledyne FLIR). The detection looks for combinations of career-themed keywords in the subject or body of an email that also contain an archive file attachment (e.g., .zip, .rar, .7z) or links, which is a common tactic for delivering malware under the guise of job applications.
Detects the presence of specific Microsoft Entra (formerly Azure AD) authentication session cookies (ESTSAUTH, ESTSAUTHPERSISTENT, ESTSAUTHLIGHT) in web proxy traffic. This activity is indicative of session cookie theft and potential replay attacks (Pass-the-Cookie) where an adversary attempts to authenticate to Microsoft services using stolen session material from an unauthorized or non-enrolled device.
KQL Query from file: The Hunt for QR Phisher
Detects inbound emails from external domains that contain both the recipient's job title and their company name in the subject or body, which is a common indicator of targeted spearphishing attacks (BEC/Whaling).
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Detects non-interactive sign-ins to Azure CLI using the 'python-requests' User-Agent by non-administrative users. This pattern is associated with the LSHIY password spray campaign, which exploits the OAuth ROPC flow for credential abuse against Microsoft 365.
Detects a potential exploitation of the SearchLeak (CVE-2026-42824) vulnerability in Microsoft 365 Copilot, where raw HTML <img> tags containing Bing Search-by-Image parameters are rendered during the streaming phase before proper sanitization occurs. This could potentially allow for SSRF or information leakage through malicious image references.
Detects non-interactive sign-ins to Microsoft 365 using the OAuth Resource Owner Password Credentials (ROPC) flow via the Azure CLI. This legacy authentication method enables attackers to bypass multi-factor authentication (MFA) by submitting credentials directly to the authentication endpoint, a technique observed in password spraying campaigns.
Detects the creation or update of mailbox inbox rules within 30 minutes of a successful sign-in event using the OAuth device code flow. This sequence is often observed in Business Email Compromise (BEC) attacks where an attacker uses a stolen or phished device code to access a mailbox and subsequently establishes persistence via malicious mail forwarding or deletion rules to hide their tracks.
Page 86 of 150