Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects sign-in activity within Microsoft Entra ID characterized by User-Agent strings indicative of automated tools, command-line HTTP clients, and security testing software. This rule is designed for anomaly detection and necessitates correlation with other context such as source IP, authentication results, and user behavior to identify potential malicious activity.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
This rule monitors and aggregates Microsoft Entra ID Privileged Identity Management (PIM) group activation logs to provide a dashboard view of group usage, member count, and recent role activations. It facilitates governance by identifying high-usage, low-usage, or unused PIM-eligible groups by correlating historical and recent activation activity with current membership data.
Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.
This rule detects potential spearphishing attempts by identifying emails with ZIP attachments that contain filenames or subjects masquerading as specific organizations or job opportunities (e.g., 'Lockheed Martin', 'Enveil'). It triggers on incoming emails containing suspicious job-lure keywords in the subject line or file attachments, which are often used to deliver initial access payloads.
Detects anomalous, non-browser process activity interacting with Microsoft Teams APIs associated with the TWINLOOT threat campaign. The rules identify suspicious token retrieval requests and unauthorized authentication headers from processes that do not identify as legitimate browser or Teams application agents, indicating potential abuse of application access tokens and authentication flows.
This rule detects email communications where the subject line contains numerical patterns matching standard credit card number formats (13-16 digits, or spaced/hyphenated variations). The purpose is to identify potential unauthorized transmission of sensitive financial data (PII/payment information) via email.
Identifies inbound email campaigns that deliver URLs to large numbers of recipients and groups activity by parent domain.
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
Detects anomalous mailbox access via the MailItemsAccessed operation, specifically identifying the unique ClientAppId and API pairing associated with the Storm-2755 (Payroll Pirates) adversary campaign. This activity indicates unauthorized access to email content, typically targeting high-value personnel such as payroll, finance, and HR staff through Adversary-in-the-Middle (AiTM) techniques.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
This rule detects potentially malicious mailbox search and item access activity in Microsoft 365. It monitors for users who trigger both 'Search' and 'MailItemsAccessed' actions within a one-hour window. The detection logic flags behavior that includes a high volume of mail access (more than 10 events) or access originating from multiple distinct IP addresses, which are common indicators of automated collection or credential compromise.
This rule detects potentially malicious service principal activity by correlating the granting of sensitive app roles with subsequent spikes in sign-in volume. It monitors AuditLogs for 'Add app role assignment to service principal' events involving high-privilege roles, then joins this data with AADServicePrincipalSignInLogs to identify if the service principal experiences a sudden, significant increase in hourly sign-ins compared to its historical baseline within 24 hours of the permission change.
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
Detects inbound email messages authenticated with an amazonses.com DKIM signature that originate from a specific Amazon SES Tokyo-region relay IP address. This may indicate an adversary is leveraging a compromised or unauthorized transactional email account (e.g., SES or third-party platforms like Resend) to send emails on behalf of a victim domain.
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
This rule detects potentially unauthorized command-line activity originating from Power Platform-related execution environments (such as Copilot Studio or Power Platform sandboxes). It specifically monitors for the execution of common system administration binaries like cmd, powershell, or curl, which, when triggered from within a low-code/cloud runtime environment, may indicate a sandbox escape or an attempt to interact with the underlying host operating system.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
This rule detects suspicious Microsoft Graph API activity involving the enumeration of user accounts within an organization. It specifically monitors for queries targeting personnel in sensitive roles such as payroll, finance, HR, and administration, as well as bulk enumeration attempts. The detection logic also flags usage of the axios HTTP library, a common tool in such reconnaissance campaigns, and aggregates results by source IP/ASN to identify coordinated efforts, such as those associated with the Storm-2755 threat actor.
Detects sign-ins from known UNC6671 residential-proxy IPs, ranked by rarity (first-seen for the user) and correlated with a following sensitive account action (MFA registration, mailbox rule change, admin role change).
Page 92 of 179