Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects non-interactive sign-ins (refresh-token usage) for Microsoft Purview Communication Compliance reviewer accounts (Administrator, Analyst, or Investigator roles) that originate from IP addresses not observed for the user in the previous 21 days. This behavior is indicative of potential token theft or session hijacking attempting to bypass multi-factor authentication.
This rule detects 'impossible travel' activity performed by users assigned to sensitive Microsoft 365 Communication Compliance roles. It monitors Azure Sign-in logs for successful authentication events occurring within a short timeframe (1 hour) from multiple distinct geographic locations (countries) or different autonomous system numbers (ASNs). This behavior is characteristic of an adversary utilizing stolen session tokens or compromised credentials to access protected administrative functions.
Detects SharePoint Online search queries involving sensitive keywords related to M&A, legal, or financial activities, excluding authorized personnel in departments such as legal or finance. This rule helps identify potential unauthorized internal reconnaissance or data staging activities within an organization's document management system.
Detects a potential account takeover scenario where a user receives a password reset notification email followed within 10 minutes by a non-SSO application password change from the same IP address. This sequence is characteristic of Adversary-in-the-Middle (AiTM) phishing or vishing campaigns where an attacker intercepts session tokens or uses social engineering to force a password reset and immediately secures the account for persistent access.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
Detects OAuth applications receiving permissions to the tenant, used for persistence and data theft. A consented app holds its own token and survives password resets and MFA, which is why consent phishing and post-compromise app registration are favored by both commodity BEC actors and nation-state (PerfectData is linked to Midnight Blizzard / APT29). Tiered: a hardcoded list of known-abused app IDs (PerfectData, eM Client, rclone, Supermailer, and others), layered over a scope-characteristic tier that catches bespoke apps by the permissions they request (Mail/EWS, Files/Sites, Directory, Application, offline_access), with admin/AllPrincipals consent escalating blast radius. Parses all three consent event shapes and resolves app identity across them.
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Detects the creation of a new inbox rule that performs email manipulation actions (forward, redirect, delete, move, or stop processing) shortly after a user account has logged in with a high or medium risk score, or an unusual result type. This pattern is commonly indicative of account compromise where an attacker establishes persistence or data exfiltration via mailbox rules.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
This rule identifies potential post-Adversary-in-the-Middle (AiTM) session hijacking by correlating suspicious initial authentication events (e.g., AiTM indicators, unusual behavioral flags) with subsequent successful sign-ins originating from known residential proxies or anonymization VPN providers within a 24-hour window.
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
This rule detects potential data exfiltration via email by identifying mass near-identical background-image URLs in the body of an email. The rule looks for a high volume (8+) of distinct URLs that contain short parameters (indicative of encoded or smuggled data) within a single email. It further refines the detection by checking for the presence of specific CSS-like syntax often used in CSS-injection keylogging techniques to force the browser or email client to send background-image requests.
Suspicious Inbox Rule Creation
Cortex XDR
Detects creation of malicious Exchange Online inbox rules used for BEC and account-takeover persistence. Normalizes both client logging paths, OWA (New-InboxRule) and Outlook desktop (UpdateInboxRules + AddMailboxRule), and flags rules with hidden names (., ,, blank, 1 to 2 chars), external forwarding, or move/delete actions paired with payment (ach, wire, invoice) or security-notification (password, MFA, Microsoft) keywords, especially with stop-processing/exit-after-execution set.
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
This rule detects 'impossible travel' activity performed by users assigned to sensitive Microsoft 365 Communication Compliance roles. It monitors Azure Sign-in logs for successful authentication events occurring within a short timeframe (1 hour) from multiple distinct geographic locations (countries) or different autonomous system numbers (ASNs). This behavior is characteristic of an adversary utilizing stolen session tokens or compromised credentials to access protected administrative functions.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
Detects signs of Adversary-in-the-Middle (AiTM) token or session replay attacks by correlating device browsing activity on known phishing domains with subsequent user sign-in events. The rule triggers if a sign-in occurs within 10 minutes of a phishing-domain visit from a different, non-corporate IP address, or if a single session exhibits multiple distinct non-corporate IP addresses within that same window.
Detects the creation of a new Service Principal followed by an immediate application of an app role assignment within one hour. The rule specifically targets service principals with names suggestive of automation, AI, or assistant-related roles (e.g., 'copilot', 'llm', 'bot'), which may indicate the use of newly created service principals for potential persistence or unauthorized access.
This rule detects the addition or update of credentials (certificates and secrets) to Azure AD applications or service principals using AuditLogs. Adversaries often perform this activity to establish persistent access to a cloud environment by 'backdooring' a trusted application or service principal with their own secret, allowing them to authenticate as that identity later.
Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.
Detects inbound emails masquerading as ServiceNow ticket notifications that solicit sensitive information (e.g., vendor IDs, invoice numbers, bank account details) via reply-only body content. This technique evades traditional SEG scanning by avoiding malicious URLs or attachments and leveraging the reputation of legitimate, though spoofed, ServiceNow infrastructure.
Page 94 of 179