Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Okta Administrative Privilege Grant
Cortex XDR
Detects administrative privilege grants to users or groups within Okta, including standard privilege grants and custom admin role bindings. This activity is often associated with account takeovers where an attacker attempts to escalate privileges or configure rogue IdP federation to maintain persistent access.
Detects anomalous OAuth redirection chains initiated from login.microsoftonline.com or accounts.google.com that target infrastructure identified as malicious .vu domains. This pattern is indicative of a consent-phishing campaign attempting to redirect users to malicious infrastructure.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
Detects the creation or modification of inbox rules in Office 365 that involve automatic email forwarding, redirection, or deletion. Such rules are commonly created by adversaries to exfiltrate email data or maintain persistent access to a compromised mailbox.
Identifies potentially suspicious email forwarding configurations, mailbox permission assignments, transport rule changes, and delegate access grants that could enable unauthorized email access or data exfiltration.
The query correlates multiple Microsoft 365 audit activities including:
Inbox forwarding rules
SMTP mailbox forwarding
Transport rule forwarding
Delegate mailbox access assignments
Removed or disabled forwarding configurations
This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
The query correlates multiple Microsoft 365 audit activities including:
Inbox forwarding rules
SMTP mailbox forwarding
Transport rule forwarding
Delegate mailbox access assignments
Removed or disabled forwarding configurations
This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
This rule monitors Microsoft Teams communication logs to identify messages containing URLs. By parsing the message content and extracting domains, this rule facilitates the detection of potentially malicious links, phishing attempts, or unauthorized data sharing within the organization's Teams environment.
Detects potential indirect prompt injection attacks against Microsoft Copilot where a 'summarize' action targeting a webpage is immediately followed by suspicious assistant behavior changes such as memory updates, suggesting the webpage content contained malicious instructions.
This rule detects anomalous behavior indicative of post-compromise reconnaissance within Jira or Atlassian environments. It monitors CloudAppEvents for high volumes of distinct view actions (e.g., issues, projects, boards, reports) performed by a single account within a one-hour window, which may signify an attacker using a compromised API token or account to harvest sensitive information from engineering and security work items.
Detects instances where Microsoft Teams logs report a message containing a 'Malicious url'. This suggests a potential phishing attempt via Teams, where a user is being sent a link classified as malicious by security systems.
Detects instances where Microsoft Copilot memory content (identified by hash) remains identical before and after a significant account security event, such as a password reset or session revocation. This behavior suggests that an adversary may have injected malicious or persistent data into the user's Copilot memory, which survives standard account remediation actions.
Detects session hijacking activity characteristic of the Mirage2FA AiTM (Adversary-in-the-Middle) phishing toolkit. The rule identifies non-interactive authentication events (token reuse) that lack an MFA challenge, occurring shortly after interaction with a known malicious phishing proxy domain. It further correlates this activity with anomalous signals, such as impossible travel or the use of an unseen device/user-agent, to confirm high-fidelity malicious intent.
Detects Microsoft Copilot interaction URLs containing the 'autorun=1' parameter alongside a 'q=' prompt parameter. This combination indicates a potential attempt to execute a prompt in the user's Copilot session without explicit user confirmation upon link click, a technique sometimes referred to as a CoSnitch or one-click attack.
Detects Microsoft Copilot interaction URLs containing the 'autorun=1' parameter alongside a 'q=' prompt parameter. This combination indicates a potential attempt to execute a prompt in the user's Copilot session without explicit user confirmation upon link click, a technique sometimes referred to as a CoSnitch or one-click attack.
Inbound email campaigns containing links to external personal SharePoint sites (*-my.sharepoint.com) sent to multiple recipients.
This rule detects anomalous behavior indicative of post-compromise reconnaissance within Jira or Atlassian environments. It monitors CloudAppEvents for high volumes of distinct view actions (e.g., issues, projects, boards, reports) performed by a single account within a one-hour window, which may signify an attacker using a compromised API token or account to harvest sensitive information from engineering and security work items.
Detects anomalous human-like interactive browsing behavior from the 'qa@snowflake.net' Jira service account. This account is typically restricted to automated ticket creation via GitHub Actions; broad exploration of Jira boards, timelines, and reports indicates a potential account compromise where an API token has been exfiltrated and repurposed for reconnaissance.
Identifies Microsoft Entra Privileged Identity Management (PIM) role activations occurring outside normal business hours or during weekends.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
This rule monitors for high-risk modifications to Zscaler security policies such as disabling SSL inspection or DLP engines, or deleting/modifying firewall and URL filtering rules. It also flags administrative logins from locations previously unseen for that user, which may indicate account compromise or unauthorized access.
Page 87 of 142