Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,934
7,265
6,535
3,865
3,645
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects successful sign-ins using legacy authentication protocols (e.g., IMAP, POP3, SMTP AUTH, ROPC) for user accounts that are in scope of a Conditional Access policy requiring multi-factor authentication (MFA). Legacy protocols do not support modern authentication flows, effectively bypassing configured MFA requirements and increasing the risk of credential-based attacks.
Detects changes to SharePoint tenant-level or site-level sharing policies that expand external access to 'Anyone' (anonymous links) or 'ExternalUserAndGuestSharing'. Such modifications represent a significant security posture regression that may facilitate unauthorized data access or facilitate exfiltration pathways.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
Detects rapid, automated enumeration of Azure AD users, groups, and directory roles via the Microsoft Graph API immediately post-compromise. This rule identifies a high volume of queries (more than 50 within a 5-minute window) originating from a single account and IP address, targeting either 'Microsoft Graph' as the application or 'SearchQueryPerformed' as the action type.
Detects non-interactive Microsoft Graph OAuth2 token requests originating from unmanaged, deviceless sessions that falsely claim MFA satisfaction. The detection focuses on specific user agents known to be associated with automated token replay attacks and looks for multiple unique token identifiers per user session, which is indicative of credential or token theft rather than standard service account or application activity.
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
This rule detects inbound emails that appear to be Microsoft Teams invitations but contain suspicious keywords in the subject line related to financial transactions (invoice, billing, payment, renewal, charge). This could indicate a phishing attempt where adversaries leverage legitimate-looking Microsoft invitation emails to deliver financially themed lures.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Detects non-interactive OAuth2 token refresh attempts targeting Microsoft 365 services where the authentication is satisfied by a pre-existing session without MFA challenge. The rule flags instances where the sign-in originates from an IP address with a different ASN or country than the user's previous interactive session and uses specific browser user-agents identified in known Adversary-in-the-Middle (AiTM) campaigns like the Payroll Pirate.
This rule detects Adversary-in-the-Middle (AiTM) session hijacking against Microsoft 365, specifically targeting the Tycoon 2FA phishing kit (associated with campaigns like Payroll Pirate). It correlates two distinct malicious behaviors: the initial MFA capture phase (involving specific error codes and spoofed user agents) and subsequent illicit token replay against the Microsoft Graph API from unmanaged devices.
Detects the use of the RoadTx tool to perform a Resource Owner Password Credential (ROPC) grant against Microsoft Graph while bypassing MFA. This behavior leverages CVE-2025-0309 by abusing hidden Conditional Access exclusions for specific client IDs, resulting in an authentication token issued without an MFA claim.
Detects the creation of new Inbox rules in Microsoft 365 that are configured to automatically move or delete emails containing payroll-related keywords such as 'direct deposit', 'bank', or 'hr'. This behavior is consistent with post-compromise activity by threat actors attempting to hide payroll fraud notifications or security alerts from the victim.
Detects a specific sign-in sequence indicative of a Payroll Pirate adversary-in-the-middle (AiTM) attack. The pattern involves a Microsoft Outlook interactive sign-in resulting in a 50199 error (Login:reprocess) followed within 10 minutes by a Cmsi:cmsi authentication attempt, both originating from the same user and the specific user-agent Firefox 142.0. This behavior is associated with 2FA proxying techniques where the attacker captures and replays session information.
This rule detects failed Microsoft 365 sign-in attempts on the OfficeHome application associated with error code 90014, indicating a malformed or missing credential payload. The detection specifically triggers when these failures originate from an iPhone/iOS user-agent. This behavior is indicative of the reconnaissance phase of the Payroll Pirate campaign (associated with threat actor Storm-2755), where attackers use mobile-simulated browsers from carrier IP ranges to probe authentication endpoints before deploying Adversary-in-the-Middle (AiTM) kits.
Detects ROPC (Resource Owner Password Credentials) token requests to Microsoft Graph using specific client IDs associated with Microsoft To-Do or Intune Company Portal. This activity could indicate an attempt to bypass MFA via hidden Conditional Access policy exclusions, as described in CVE-2025-0309.
This rule detects the creation of Temporary Access Passes (TAPs) via the Microsoft Graph API targeting highly privileged accounts. This activity could indicate an attacker abusing a service principal with UserAuthMethod-TAP.ReadWrite.All permissions to gain temporary access to critical accounts like Global Administrators, Privileged Role Administrators, or Security Administrators. The rule specifically looks for POST requests to the 'temporaryAccessPassMethods' endpoint in Microsoft Graph Activity Logs and correlates this with IdentityInfo to identify if the target user holds a privileged role.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects a sequence of events indicative of a successful phishing attack: a user receives an email containing a suspected phishing URL, clicks the URL, and subsequently performs a successful sign-in from an IP address not seen in their recent 14-day history within 15 minutes of the click.
This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.
Detects inbound emails containing attachments with file extensions commonly used for HTML/SVG smuggling (.html, .htm, .svg, .shtml, .xhtml). This technique is often used to bypass email security filters by assembling malicious payloads client-side after the email has been delivered. The rule specifically looks for inbound emails where the attachment has not been blocked or junked by the email gateway.
This rule detects potential phishing attempts where users receive SharePoint sharing invitations or links from external tenants that are not part of the organization's trusted SharePoint environment. It identifies inbound emails from SharePoint notification senders containing URLs to external SharePoint tenants and also flags internal SharePoint sharing events (invitations or anonymous link creations) initiated by accounts whose domain differs from the home tenant. This could indicate an attacker attempting to lure users to malicious external SharePoint sites or using compromised accounts to facilitate external sharing.
Page 96 of 150