Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects inbound emails where the sender domain mimics finance-themed brands (using a regex-based pattern) and includes URLs redirecting through the ActiveCampaign platform tracking domains (activehosted.com or acemlnd.com). This rule identifies potential phishing campaigns attempting to use legitimate email marketing infrastructure to bypass reputation-based filters.
This rule correlates Microsoft Defender for Office 365 'Safe Links' phishing alerts, which indicate a user has clicked a potentially malicious URL. It extracts the malicious domain from the URL and aggregates multiple alert events by that domain to identify potential phishing campaigns impacting multiple users within the organization.
Detects Microsoft Teams messages containing specific external domains, which may indicate phishing or unauthorized sharing of malicious links within the organization.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
Tracks changes and activities affecting a specific user account across both on-premises Active Directory and Microsoft Entra ID. The query combines Windows Security Events and Entra ID Audit Logs into a single timeline, making it easier to investigate account modifications, privilege changes, MFA updates, directory synchronization activity, and administrative actions impacting a user.
This detection is particularly useful during incident response, insider threat investigations, account compromise assessments, and user lifecycle reviews
This detection is particularly useful during incident response, insider threat investigations, account compromise assessments, and user lifecycle reviews
This rule detects potential phishing activity by identifying bulk email campaigns (5 or more recipients) where either the email subject contains known suspicious keywords (e.g., 'password', 'urgent', 'invoice') or the Reply-To address domain differs from the sender domain. The rule specifically excludes emails with attachments or URLs, focusing on social engineering pretexts that aim to initiate a conversation or gather information without external payloads.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
This rule detects potential session token replay attacks in Azure Active Directory by correlating interactive or single-factor sign-in events using 'python-requests' user agents (common in automated tooling) with subsequent 'Register device' and 'Register security info' (Windows Hello for Business) activity within a 48-hour window. This behavior often indicates an adversary attempting to register a device to a compromised account to maintain persistence or bypass MFA requirements.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Correlates email delivery, URL click telemetry, endpoint network connections, and process execution evidence for one or more suspicious URLs or domains.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
Detects the creation or modification of inbox rules in Office 365 that involve automatic email forwarding, redirection, or deletion. Such rules are commonly created by adversaries to exfiltrate email data or maintain persistent access to a compromised mailbox.
Identifies potentially suspicious email forwarding configurations, mailbox permission assignments, transport rule changes, and delegate access grants that could enable unauthorized email access or data exfiltration.
The query correlates multiple Microsoft 365 audit activities including:
Inbox forwarding rules
SMTP mailbox forwarding
Transport rule forwarding
Delegate mailbox access assignments
Removed or disabled forwarding configurations
This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
The query correlates multiple Microsoft 365 audit activities including:
Inbox forwarding rules
SMTP mailbox forwarding
Transport rule forwarding
Delegate mailbox access assignments
Removed or disabled forwarding configurations
This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
This rule monitors for incoming emails containing suspicious attachments (such as .htm, .xhtml, .svg, or QR codes) associated with common business-related subject lines or file names (e.g., 'contract', 'agreement', 'edocs'). It specifically identifies emails originating from 'amazonses.com' that do not match expected trusted domains like DocuSign or Workday, indicating a potential credential harvesting or phishing attempt.
This rule monitors Microsoft Teams communication logs to identify messages containing URLs. By parsing the message content and extracting domains, this rule facilitates the detection of potentially malicious links, phishing attempts, or unauthorized data sharing within the organization's Teams environment.
Detects potential indirect prompt injection attacks against Microsoft Copilot where a 'summarize' action targeting a webpage is immediately followed by suspicious assistant behavior changes such as memory updates, suggesting the webpage content contained malicious instructions.
Detects instances where Microsoft Teams logs report a message containing a 'Malicious url'. This suggests a potential phishing attempt via Teams, where a user is being sent a link classified as malicious by security systems.
Detects instances where Microsoft Copilot memory content (identified by hash) remains identical before and after a significant account security event, such as a password reset or session revocation. This behavior suggests that an adversary may have injected malicious or persistent data into the user's Copilot memory, which survives standard account remediation actions.
Detects session hijacking activity characteristic of the Mirage2FA AiTM (Adversary-in-the-Middle) phishing toolkit. The rule identifies non-interactive authentication events (token reuse) that lack an MFA challenge, occurring shortly after interaction with a known malicious phishing proxy domain. It further correlates this activity with anomalous signals, such as impossible travel or the use of an unseen device/user-agent, to confirm high-fidelity malicious intent.
Page 90 of 179