Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects Microsoft Copilot interaction URLs containing the 'autorun=1' parameter alongside a 'q=' prompt parameter. This combination indicates a potential attempt to execute a prompt in the user's Copilot session without explicit user confirmation upon link click, a technique sometimes referred to as a CoSnitch or one-click attack.
Detects Microsoft Copilot interaction URLs containing the 'autorun=1' parameter alongside a 'q=' prompt parameter. This combination indicates a potential attempt to execute a prompt in the user's Copilot session without explicit user confirmation upon link click, a technique sometimes referred to as a CoSnitch or one-click attack.
Inbound email campaigns containing links to external personal SharePoint sites (*-my.sharepoint.com) sent to multiple recipients.
This rule monitors outbound email traffic per sender and flags accounts exceeding a specified hourly threshold. A sudden spike in outbound emails from a single user account may indicate a compromised mailbox being used for spam, phishing, or mass data exfiltration.
Identifies Microsoft Entra Privileged Identity Management (PIM) role activations occurring outside normal business hours or during weekends.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
Detects modifications, registrations, or deletions of security information for a user account, or general management updates within the user directory, which may indicate account tampering or unauthorized privilege persistence.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
This rule monitors Microsoft 365 SharePoint and OneDrive audit logs for the 'SharingSet' operation to detect when internal items are shared with external guests. It classifies sharing events based on permission level and site type (Personal vs. SharePoint site) to highlight potentially high-risk external collaboration.
Provides a consolidated view of email metadata, delivery outcomes, attachments, embedded URLs, sender infrastructure, and security verdicts for inbound and outbound email investigations.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
Detects inbound emails containing password-protected archives (rar, zip, 7z) from either common freemail providers or domains matching known social engineering themes (e.g., webinar, interview, research). The rule specifically flags emails where the subject or body includes password hints (e.g., 'pwd', 'extract', 'unzip') indicating an attempt to deliver malicious payloads while evading email gateway inspection.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
This rule detects user interaction with potentially malicious URLs from known Dynamic DNS (DDNS) providers or URLs containing suspicious keywords frequently associated with phishing lures (e.g., login, auth, verify, mfa). It filters out known legitimate Microsoft domains to reduce noise.
Detects email from a new hire (within 30 days of hire date) combining personal-crisis pretext language with an explicit request to use a personal or unmanaged device, corroborated by a non-compliant or untrusted device sign-in, consistent with PurpleDelta's device-substitution social-engineering pattern.
Detects successful Microsoft Entra RoleManagement activity where a member is assigned permanently to a role outside of Privileged Identity Management (PIM). This is flagged as a privileged access risk because it bypasses just-in-time eligibility and activation controls.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
Aggregates identity, endpoint, cloud application, and messaging telemetry to build a consolidated profile of the devices, clients, applications, and user agents associated with a specific user account.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
Correlates Microsoft Entra Privileged Identity Management (PIM) role eligibility with actual activation activity to identify how privileged roles are being used across the environment.
The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated.
This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated.
This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
Correlates Microsoft Entra identity risk detections with subsequent password changes, MFA registrations, and security information modifications. Helps identify potential account compromise scenarios where authentication methods or credentials are altered after suspicious sign-in activity.
Detects email communications from a recently-created account (within 60 days of account creation) requesting redirection of payroll or business payments to a personal bank account under a fabricated 'bank account under review' pretext, consistent with PurpleDelta payment-fraud tradecraft.
Detects Microsoft Entra audit events where a user is added to either the Global Administrator or Cloud Device Administrator built-in roles, which are high-privilege administrative roles.
Identifies suspicious inbound bulk email campaigns by correlating sender behaviour, recipient spread, URL evidence, Safe Links click telemetry, external SharePoint links, post-delivery remediation actions, and campaign delivery outcomes.
The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions.
It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction.
Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions.
It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction.
Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
Page 91 of 179