Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,934
7,265
6,535
3,865
3,645
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects anomalous or suspicious behavior from Microsoft 365 Copilot agents, plugins, or sessions. This includes bulk access to files containing sensitive keywords, unauthorized export or sharing of sensitivity-labeled documents, and high-volume Microsoft Graph API read activity targeting sensitive paths in SharePoint or OneDrive.
Detects the transmission of potential sensitive information, such as passwords, tokens, API keys, or private keys, within Microsoft Teams chat messages by matching message content against a regular expression pattern for common credential formats.
This rule detects anomalous or risky sign-in events for user accounts that have recently configured an active out-of-office (OOF) auto-reply. An attacker may leverage a user's known absence to gain access to their email or other corporate resources using compromised credentials, as the user is less likely to notice suspicious account activity while away.
This rule detects anomalous or risky sign-in events for user accounts that have recently configured an active out-of-office (OOF) auto-reply. An attacker may leverage a user's known absence to gain access to their email or other corporate resources using compromised credentials, as the user is less likely to notice suspicious account activity while away.
Detects a multi-stage attack pattern involving a 'spam bomb' (high volume of inbound emails) followed by an external Microsoft Teams message and the subsequent execution of Windows Quick Assist (quickassist.exe or msra.exe) on the target endpoint. This behavior is highly indicative of a tech support scam or social engineering attack where an adversary floods a user's inbox to create urgency, contacts them via Teams, and convinces them to initiate a remote support session.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
Detects successful sign-ins to Microsoft Graph where Multi-Factor Authentication (MFA) was expected but not applied or not enabled, and the authentication method used was not MFA or passwordlessMFA. This could indicate an MFA bypass or misconfiguration, allowing access to sensitive resources without the required second factor.
Detects phishing emails impersonating Booking.com, specifically targeting Japanese users with malicious .cfd domains, suspicious subject lines, or attachments like 'invite.ics'. The rule assigns risk scores based on specific indicators such as URL patterns, body text, and sender domains.
Detects spearphishing emails delivered through Google Workspace infrastructure that fail DMARC strict alignment check. Specifically, this monitors instances where the DKIM signing domain is a gappssmtp.com subdomain that fails alignment with the envelope sender domain, while concurrently carrying a PDF attachment, consistent with known phishing campaign patterns.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule monitors incoming email events for a specific domain or sender address, detecting instances where emails pass DKIM validation but fail DMARC and SPF checks while simultaneously being flagged as spam by the email security solution. This pattern is indicative of potential spoofing or unauthorized email activity.
Detects incoming emails purportedly from a specific domain ('gasparinutrition.com') that exhibit signs of spoofing or malicious activity. The rule looks for DMARC failures, DKIM misalignment, and presence of specific document attachments or subject lines (e.g., 'Distribution Settlement Agreement') that mimic business correspondence often used in social engineering or phishing campaigns.
Detects a potential exploitation attempt of CVE-2026-42824, involving a parameter-to-prompt injection in M365 Copilot to extract sensitive data identifiers, followed by an exfiltration attempt via a Bing Search-by-Image SSRF request.
Detects potential financial data exfiltration by monitoring for bulk downloads of files with financial keywords from SaaS/Office365 platforms, and identifies unauthorized processes attempting to access sensitive financial application data files (.qbw, .qbb, etc.) on local systems.
This rule detects two suspicious activities within a user's mailbox: (1) An email flood, where a recipient receives more than 500 emails within a 5-minute window, potentially indicating an attempt to overwhelm or hide secondary emails; and (2) The creation or modification of inbox rules that include actions like deleting or moving messages, which is a common persistence and evasion technique used by attackers to hide C2 or phishing communications.
This rule detects network activity and email signals associated with a malicious campaign promoting a fraudulent 'Perplexity AI' Chrome extension. It monitors for connections to known malicious Tilda landing pages, correlates these visits with subsequent Google Chrome extension (CRX) downloads within a 10-minute window, and identifies phishing emails containing links to these malicious pages.
This rule detects anomalous or risky sign-in events for user accounts that have recently configured an active out-of-office (OOF) auto-reply. An attacker may leverage a user's known absence to gain access to their email or other corporate resources using compromised credentials, as the user is less likely to notice suspicious account activity while away.
Detects enumeration of email accounts via Exchange Web Services
Detects incoming phishing emails that impersonate healthcare-related organizations. The detection identifies malicious activity by matching common healthcare-themed domain patterns in the From header, coupled with email authentication failures (DMARC or DKIM), and a mismatch between the envelope sender and the header From address. It also monitors for invoice-themed subject line lures commonly used in social engineering.
This rule detects persistent Microsoft 365 access established by an attacker using OAuth refresh tokens, typically following a device_code phishing attack. It correlates three key events: initial device_code sign-ins from non-compliant or non-managed devices, the subsequent consent to a new OAuth application (likely attacker-controlled) from the same user and within a short timeframe, and finally, Microsoft Graph mail API access originating from that newly registered application. This sequence indicates an adversary has successfully phished a user, gained consent for a malicious application, and is now using it to access the user's mailbox data.
This rule detects invoice-themed phishing emails that impersonate healthcare organizations. It identifies suspicious messages by analyzing email authentication failures (DKIM/DMARC/SPF) and specific delivery conditions like 'compauth=none' or 'reason=451', which are often indicative of phishing campaigns leveraging open redirect services for obfuscation.
Page 95 of 150