Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,864
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects instances where a guest user is invited to the organization using an email address from potentially malicious TLDs (e.g., .ru, .cn, .ir, .kp) or a domain structure that is represented as an IP address. These patterns are often associated with phishing, reconnaissance, or adversary attempts to gain a foothold in an environment by inviting external identities.
Detects bulk file access, download, or sync operations by a single user account within a 30-minute window in Microsoft SharePoint Online or OneDrive for Business. This behavior is indicative of potential data exfiltration or unauthorized mass collection of sensitive information.
Detects when an administrator explicitly disables Unified Audit Log (UAL) ingestion for Exchange Online using the Set-AdminAuditLogConfig cmdlet. This action effectively stops the generation of audit records for Exchange administration and user activity, a critical defense evasion tactic used to conceal malicious operations.
Detects HTTP requests to Microsoft 365 search endpoints containing unusually long query strings. Such patterns may indicate automated data extraction, exfiltration over alternative protocols, or unauthorized information harvesting via search parameters.
This rule detects potentially malicious search queries within Microsoft 365 or Copilot-related URLs intercepted by email gateways, proxies, or SIEM sources. It monitors for suspicious query parameters that may indicate attempts to hide malicious content, such as HTML tags (e.g., <img>), image-related keywords, or excessively long query strings, which could be indicative of phishing attempts or browser-based exploitation techniques.
This rule detects potential Server-Side Request Forgery (SSRF) exploitation where Bing's 'search by image' functionality is abused to fetch external, non-Microsoft controlled URLs. The query monitors web proxy logs for specific Bing search parameters ('cbir=sbi' and 'imgurl') and filters out requests to trusted domains, effectively identifying attempts to use the search engine as an intermediary for unauthorized external web requests. The rule further correlates these hits with Microsoft Copilot interaction logs to identify if the activity is associated with authenticated Copilot user sessions.
This rule detects potentially malicious email attachments masquerading as 'Distribution Settlement Agreements'. It flags PDF attachments that match these specific filenames when delivered in emails associated with identified suspicious domains (gasparinutrition.com, gappssmtp.com) or when authentication checks like DMARC fail.
Detects the SearchLeak (CVE-2026-42824) exploit, where an attacker uses a prompt-injected M365 Copilot URL to force the assistant to search the victim's mailbox for sensitive authentication information such as MFA codes, OTPs, or security passcodes. The rule correlates an external HTTP request containing the malicious URL with a subsequent Exchange search query initiated by the Copilot service within a 2-minute window.
This rule detects enumeration of directory roles (specifically targeting privileged roles like Global Administrators) in Azure AD/Microsoft Entra ID, correlated with sign-in activity originating from IP addresses outside of defined corporate network ranges. This behavior is indicative of reconnaissance activities by an adversary who has gained initial access via a compromised identity.
Detects potential exploitation of CVE-2025-0309, where the Intune Company Portal application identifier is used to acquire Microsoft Graph tokens via a password grant mechanism while bypassing Multi-Factor Authentication (MFA). This technique typically relies on exploiting misconfigured Conditional Access policies that exclude the Intune resource from mandatory MFA enforcement.
Detects internal emails with subject or body content related to payroll information changes (e.g., direct deposit, bank account redirection) sent to HR or payroll-related email addresses or recipients. This behavior is indicative of internal Business Email Compromise (BEC) or an attempt by an attacker (or compromised insider) to facilitate payroll fraud.
Detects high-risk activity where a user session, characterized by specific suspicious browser user agents and non-interactive authentication (indicative of token replay/session hijacking), is followed by changes to Workday payroll information (direct deposit, banking details) or unauthorized access to HR-related email content.
This rule monitors Microsoft Graph API audit logs for suspicious activity targeting user objects. It specifically detects attempts at bulk enumeration, use of pagination to circumvent limits, or searches using keywords associated with sensitive organizational data (e.g., payroll, finance, hr, admin).
This rule detects potential brute force or credential stuffing attacks against Azure AD by identifying multiple failed sign-in attempts followed by a successful sign-in from the same user and IP address within a short time frame (1 minute). It specifically looks for scenarios where the successful sign-in occurs after the failed attempts and involves different applications, excluding common Office 365 services to reduce noise.
This rule detects network connections and email URLs that match known typosquatted patterns of Microsoft domains. It aims to identify potential phishing attempts or traffic directed to infrastructure used by the 'Bulletproof Redirect Engine' masquerading as legitimate Microsoft services. The logic filters out legitimate Microsoft-related URLs to minimize false positives.
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
Detects the transmission of potential sensitive information, such as passwords, tokens, API keys, or private keys, within Microsoft Teams chat messages by matching message content against a regular expression pattern for common credential formats.
This rule detects extortion emails that claim corporate data theft and threaten public release unless a cryptocurrency payment is made. It looks for a combination of breach-related subject lines, extortion-specific language in the email body, and indicators such as specific cryptocurrency mentions, urgent deadlines, usage of anonymous email providers, or references to attached proof of compromise.
Detects phishing emails sent from personal Gmail accounts that use URL shorteners, include urgency-based legal lures in the subject line, and pass SPF/DKIM/DMARC authentication checks. The rule looks for indicators of spearphishing attempts leveraging social engineering and common evasion techniques like BCC delivery to bypass standard security filters.
Detects high-volume Microsoft Graph API and SCIM endpoint enumeration consistent with employee directory scraping, potentially by threat groups like BlackFile/Cordial Spider. This rule identifies suspicious activity based on a high count of directory queries or distinct URIs accessed within a short time frame, originating from non-Microsoft/Google/Amazon/IBM ASNs and using common scripting/API user agents.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Page 93 of 150