Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects anomalous email access patterns across multiple mailboxes using specific application identifiers or access contexts often associated with automated collection tools. This rule flags when an application accesses more than 20 items across distinct mailboxes in a 15-minute window, which is indicative of potential unauthorized bulk email collection or data exfiltration.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects successful Azure AD sign-ins where the user agent identifies as a Python requests library version (2.33.1 or 2.34.2) that has not been observed for that specific user account in the preceding 14 days. This behavior is indicative of anomalous automated or scripted access.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
Detects Direct Send bypass (null envelope + internal-domain spoof) using a file/document-sharing lure aimed at leadership. Tightened: added inbound-direction and auth-failure requirements (was previously missing any authentication check, so legitimate SharePoint/OneDrive-style sharing notifications from real internal senders could have matched), delivered-only filter, and case-insensitive recipient/job-title join.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects SCL-9 (high-confidence phishing/spam) messages that still reach an inbox, indicating an allow-list or transport-rule override, and enriches with any recent tenant mail-flow admin changes. Rewritten: removed a no-op self-join on EmailEvents and a broken exact-match join against CloudAppEvents' raw audit blob (was comparing a sender address against a whole JSON record and would never match); now excludes messages later auto-remediated (e.g. ZAP-quarantined) via the native LatestDeliveryLocation field, and correlates admin rule/allow-list changes via substring match over a cross join.
Detects SCL-9 (high-confidence phishing/spam) messages that still reach an inbox, indicating an allow-list or transport-rule override, and enriches with any recent tenant mail-flow admin changes. Rewritten: removed a no-op self-join on EmailEvents and a broken exact-match join against CloudAppEvents' raw audit blob (was comparing a sender address against a whole JSON record and would never match); now excludes messages later auto-remediated (e.g. ZAP-quarantined) via the native LatestDeliveryLocation field, and correlates admin rule/allow-list changes via substring match over a cross join.
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
Detects the RejectDirectSend bypass (null SMTP envelope sender + internal-domain spoof). Tightened to require Microsoft's composite auth verdict OR all of SPF/DKIM/DMARC failing (vs. any one), excludes known-approved Direct Send relay IPs, and excludes likely-legitimate bulk/newsletter traffic via BulkComplaintLevel.
Detects inbound emails where the sender domain mimics finance-themed brands (using a regex-based pattern) and includes URLs redirecting through the ActiveCampaign platform tracking domains (activehosted.com or acemlnd.com). This rule identifies potential phishing campaigns attempting to use legitimate email marketing infrastructure to bypass reputation-based filters.
This rule identifies phishing attempts by detecting inbound emails where the sender's domain or any embedded URLs within the email content match a pre-defined list of known malicious domains. It flags emails for further investigation by correlating sender domain data and URL information found in the email communication.
This rule detects incoming emails that contain common phishing lure keywords or reference ID patterns in the subject line, combined with signs of email spoofing (same sender/recipient domain) or a failure in email authentication protocols (DKIM, SPF, or DMARC).
Detects instances where a user account performs a device configuration change (such as updating compliance policies) followed by a potentially destructive operation (Wipe, Retire, or Delete) on the same device or entity within a 6-hour window. This behavior often suggests unauthorized administrative activity or a malicious insider attempting to disable security controls before removing access or destroying data.
This rule correlates successful Microsoft 365 sign-in events with preceding network events involving identified NovaCookies AiTM phishing infrastructure (specifically targeting .vu domains or specific URL patterns). It triggers when a user successfully authenticates using MFA shortly after accessing a known phishing link, which is a strong indicator of an active AiTM session hijacking attempt.
Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.
Detects when an AI agent (agentic identity as identified by Entra ID agentType) is added to a group. This activity could represent legitimate provisioning of agent-based workflows, but if unexpected, it may indicate potential privilege escalation or persistence via group-based role assignments.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
Page 88 of 179