Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects potential cloud data exfiltration by identifying anomalous device-code authentication sign-ins followed by high-velocity file or mailbox access. It specifically monitors Microsoft 365 sign-in logs for device-code authentication sessions involving either an application (AppId) or a geographic location not seen in the user's previous 14-day baseline. If such a sign-in is immediately followed (within a 2-hour window) by a rapid burst of activity in SharePoint, OneDrive, or Exchange—defined by at least 20 operations at a rate of 5 or more events per minute—the rule flags the sequence as suspicious. This pattern is characteristic of attackers using stolen device-code tokens to programmatically mass-download or exfiltrate sensitive cloud data.
Detects anomalous, high-volume access, download, or synchronization activity in SharePoint or OneDrive within a one-hour window. The rule focuses on non-interactive user agents typically used by scripting libraries (e.g., Python requests, PowerShell, Go-http-client) and flags activity that exceeds an individual user's 21-day rolling baseline, suggesting potential automated data exfiltration or mass collection.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
This rule detects the addition or update of credentials (certificates and secrets) to Azure AD applications or service principals using AuditLogs. Adversaries often perform this activity to establish persistent access to a cloud environment by 'backdooring' a trusted application or service principal with their own secret, allowing them to authenticate as that identity later.
Detects inbound emails originating from a gmail.com sender that have not previously communicated with the recipient in the last 90 days. The rule identifies emails containing e-card or greeting card-themed subjects, which are often used as social engineering lures to masquerade as automated branded notifications for malicious activity or credential theft.
Detects Microsoft Entra device registration events where the device name adheres to the 'Forg365-' prefix naming convention. This pattern is indicative of persistence mechanisms used by the Forg365 Phishing-as-a-Service (PhaaS) platform, which registers devices to bypass conditional access or MFA.
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
Detects phishing attempts where the sender's display name implies a sensitive role (e.g., Accounts Payable, Helpdesk, Vendor) while the authenticated header-From domain utilizes a 'support' subdomain. The rule triggers when the organizational root domain extracted from the email sender address does not match the branding present in the sender display name, indicating potential brand impersonation or business email compromise.
This rule identifies potential account compromise or session hijacking by correlating anomalous outbound email patterns with risky sign-in events. It monitors for users who send outbound emails to a threshold of previously unseen external recipients within a short window after authenticating under suspicious conditions, such as high-risk sign-in flags, atypical locations, or unfamiliar applications. This pattern is indicative of attackers using stolen session tokens or compromised credentials to perform mass outbound phishing, spamming, or data exfiltration from an internal mailbox.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by correlating network events indicating a connection to a known phishing domain with subsequent suspicious authentication behavior. Specifically, it identifies sessions associated with non-corporate IP addresses that show evidence of token reuse (e.g., multiple distinct IP addresses for the same session identifier) occurring within a short window after accessing a phishing portal.
This rule detects potential mass data retrieval or excessive access to sensitive-labeled files by an individual user through Microsoft Copilot within a one-hour window. By monitoring the volume of distinct sensitivity-labeled objects accessed, it identifies behavior consistent with a user or compromised account performing high-volume information gathering.
This rule monitors Azure Active Directory (Microsoft Entra ID) audit logs for the addition or modification of application registrations that contain specific, potentially malicious redirect URI patterns ('brk-' or 'brk-multihub'). These patterns are associated with OAuth consent phishing or malicious application authorization where an adversary registers an app to intercept authorization codes.
Detects the delivery of a malicious SVG data-URI payload targeting the CVE-2026-42897 vulnerability in Outlook Web Access (OWA). This exploit uses a base64-encoded SVG image embedded in an email body, which triggers an onload JavaScript handler when rendered by OWA, leading to potential code execution within the mailbox context.
This rule detects high-volume file access or download operations in SharePoint or OneDrive, performed by non-browser user agents (e.g., Python, PowerShell, cURL, Go). An elevated volume of such actions within a short timeframe is indicative of automated, scripted interaction, which may represent malicious data exfiltration, automated content scraping, or potential account compromise.
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
Detects the execution of known remote monitoring and management (RMM) or remote access tools shortly after Microsoft Teams process activity on a host. This behavior is consistent with helpdesk-impersonation vishing attacks where an adversary convinces a user to initiate a remote session.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
This rule detects potential phishing emails that successfully pass through to the mailbox despite failing SPF, DKIM, or DMARC authentication checks. It specifically flags emails that claim to originate from high-value vendor domains (e.g., DocuSign, Zoom, Adobe, RingCentral) but contain links to external domains that do not match the alleged sender's domain, which is a common indicator of brand impersonation or credential harvesting campaigns.
Page 95 of 179