Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects Microsoft 365 service principals using application-only (client-credentials) authentication to access the Microsoft Graph API, specifically targeting the calendarView endpoint of user mailboxes. This behavior matches the HOLLOWGRAPH attack technique, which leverages M365 calendars as a covert command-and-control (C2) channel.
Detects Office 365 calendar events created or modified with a specific far-future date (2050-05-13) or dates scheduled more than 10 years into the future. This behavior is associated with the HOLLOWGRAPH backdoor, which uses calendar items as a C2 channel to hide tasking or exfiltration events from the mailbox owner.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
Detects the creation of a new Service Principal followed by an immediate application of an app role assignment within one hour. The rule specifically targets service principals with names suggestive of automation, AI, or assistant-related roles (e.g., 'copilot', 'llm', 'bot'), which may indicate the use of newly created service principals for potential persistence or unauthorized access.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.
Suspicious Inbox Rule Creation
Cortex XDR
Detects creation of malicious Exchange Online inbox rules used for BEC and account-takeover persistence. Normalizes both client logging paths, OWA (New-InboxRule) and Outlook desktop (UpdateInboxRules + AddMailboxRule), and flags rules with hidden names (., ,, blank, 1 to 2 chars), external forwarding, or move/delete actions paired with payment (ach, wire, invoice) or security-notification (password, MFA, Microsoft) keywords, especially with stop-processing/exit-after-execution set.
This rule detects potentially malicious modifications to agent configurations by monitoring for multiple significant changes within a short time frame (2 days) compared to a 14-day baseline. Monitored indicators include: changes to instructions, addition of new Model Context Protocol (MCP) servers, addition of new owners, and expansion of access permissions to include the entire organization. An alert is triggered when an agent exhibits at least two of these signals simultaneously.
The query builds a 14-day baseline snapshot and a 2-day current snapshot per agent from AgentsInfo, computes the four signals independently, then correlates them by AgentId and surfaces only agents with 2 or more signals firing in the same window. Output is a prioritized triage list instead of four separate alert streams.
The query builds a 14-day baseline snapshot and a 2-day current snapshot per agent from AgentsInfo, computes the four signals independently, then correlates them by AgentId and surfaces only agents with 2 or more signals firing in the same window. Output is a prioritized triage list instead of four separate alert streams.
This rule monitors Azure Active Directory (Microsoft Entra ID) audit logs for the addition or modification of application registrations that contain specific, potentially malicious redirect URI patterns ('brk-' or 'brk-multihub'). These patterns are associated with OAuth consent phishing or malicious application authorization where an adversary registers an app to intercept authorization codes.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
This rule detects potential phishing emails that successfully pass through to the mailbox despite failing SPF, DKIM, or DMARC authentication checks. It specifically flags emails that claim to originate from high-value vendor domains (e.g., DocuSign, Zoom, Adobe, RingCentral) but contain links to external domains that do not match the alleged sender's domain, which is a common indicator of brand impersonation or credential harvesting campaigns.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
During my vacation, I've been enjoying conversations with people from different countries about their national teams and the World Cup. What I don't expect (although it certainly can happen) is a Mexican speaking Japanese, a Spaniard speaking Russian, or an Egyptian speaking Spanish. Yet, this is becoming more and more common, and I love it. Our world is becoming increasingly connected and multicultural.
However, the same logic doesn't always apply to emails.
That thought inspired me to build a KQL query that I'll explore further after my break, but I wanted to share it now. The idea is detect emails where the language doesn't match the expected language(s) of the sender's country. While this isn't a detection by itself, it can be a valuable hunting signal when combined with other indicators.
KQL Query Filter options:
EmailCount < X → Filter based on the number of emails observed.
Country !in ("Spain") → Exclude countries with a higher false-positive ratio.
SenderDomains !in ("Domain1","Domain2") → Exclude trusted sender domains.
However, the same logic doesn't always apply to emails.
That thought inspired me to build a KQL query that I'll explore further after my break, but I wanted to share it now. The idea is detect emails where the language doesn't match the expected language(s) of the sender's country. While this isn't a detection by itself, it can be a valuable hunting signal when combined with other indicators.
KQL Query Filter options:
EmailCount < X → Filter based on the number of emails observed.
Country !in ("Spain") → Exclude countries with a higher false-positive ratio.
SenderDomains !in ("Domain1","Domain2") → Exclude trusted sender domains.
This rule aggregates SharePoint activity logs for a specific user within a defined timeframe. It groups activities by operation and file, intended to support investigation into potential mass file access or data staging behavior by a specific user in SharePoint.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. It monitors for suspicious network connections to known Evilginx-style subdomains (e.g., owa, sso, secure, billing) that proxy traffic to login.microsoftonline.com, followed immediately by a successful user login event on the same host. This pattern indicates an active session hijacking attempt designed to capture session cookies like ESTSAUTH and ESTSAUTHPERSISTENT.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Detects the creation of user accounts or identity updates that utilize naming conventions or email domains associated with 'wp2shell' malicious activity patterns. This is commonly used in WordPress exploitation scenarios to establish persistent unauthorized administrative access.
Page 96 of 179