Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,926
7,251
6,535
3,864
3,632
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
This rule detects potential post-compromise mailbox reconnaissance by correlating suspicious sign-in events (non-interactive or unmanaged device usage, often associated with AiTM token replay) with subsequent mailbox or compliance search operations targeting payroll and HR-related keywords within a 60-minute window.
Detects potential Microsoft 365 session token replay attacks, often associated with Adversary-in-the-Middle (AiTM) kits. The rule identifies suspicious sign-in activity originating from proxy or anonymized IP addresses where MFA was bypassed or incomplete, coupled with a geographic location that deviates from the user's established 30-day baseline or constitutes a new, unseen location.
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
This rule detects two suspicious activities within a user's mailbox: (1) An email flood, where a recipient receives more than 500 emails within a 5-minute window, potentially indicating an attempt to overwhelm or hide secondary emails; and (2) The creation or modification of inbox rules that include actions like deleting or moving messages, which is a common persistence and evasion technique used by attackers to hide C2 or phishing communications.
Detects potential phishing campaigns by identifying bulk inbound emails sent to generic recipient aliases (e.g., info@, support@) or to empty recipient fields, combined with subject lines referencing urgent legal or compliance matters (e.g., lawsuits, subpoenas, copyright infringement). The rule uses statistical analysis to flag high-volume emails and correlates them across shared body content patterns to identify coordinated mass-mailing campaigns.
This rule detects exploitation attempts against Microsoft 365 Copilot (CVE-2026-42824) where attackers inject HTML or malicious prompt sequences into the 'q' query parameter. These payloads aim to perform prompt injection, SSRF via Bing, and cross-site scripting to exfiltrate sensitive data such as mailbox content and MFA tokens.
Detects anomalous bulk data access activity within SharePoint or OneDrive where the Microsoft Copilot application is the primary interface. This activity pattern is consistent with SearchLeak-style organizational permission abuse, where an AI assistant may be used to discover and access a large number of distinct files that a user might not otherwise access manually.
Detects potential data exfiltration from Microsoft 365 Copilot sessions where the Bing 'Search by Image' functionality is abused as an SSRF proxy. The rule identifies network requests containing external URLs within the 'imgurl' parameter, occurring shortly after Copilot activity, suggesting that internal or sensitive data (such as emails, calendar items, or MFA context) is being transmitted to an unauthorized external endpoint.
Detects OAuth application consent grants or modifications where the application is granted sensitive permissions including Mail.Read, Directory.Read.All, or User.Read.All. These permissions can be abused by attackers to exfiltrate email data or map the organization's directory.
Detects high frequency of denied Multi-Factor Authentication (MFA) requests for a specific user and IP address, indicating potential 'MFA fatigue' or 'MFA bombing' attacks where an adversary attempts to force a user to approve a push notification or code verification.
Detects successful assignment of highly privileged roles (Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator) to a user in Microsoft Entra ID (formerly Azure AD). This is often a sign of privilege escalation or persistence establishment by an attacker.
This rule detects potential token theft or MFA bypass by correlating successful MFA-satisfied interactive sign-ins with subsequent non-interactive sign-ins (token refreshes) occurring within a 60-minute window from different IP addresses for the same user. This pattern is indicative of an attacker stealing a session token (e.g., via session cookie theft or AiTM phishing) and using it to authenticate from a different location.
Detects instances where a user successfully authenticates using Multi-Factor Authentication (MFA) from one location, followed by a Single-Factor Authentication (SFA) logon from a different location within a 10-minute window. This behavior is indicative of potential session hijacking or session cookie theft where an attacker reuses an authenticated session or manipulates the authentication flow to bypass MFA requirements.
Detects successful Microsoft 365 user authentications where Conditional Access (CA) policies were bypassed, resulting in single-factor authentication. This pattern is indicative of attackers using compromised edge network appliances—which are often configured as trusted network locations—to proxy authentication requests and circumvent security controls.
Page 91 of 150