Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,934
7,265
6,535
3,865
3,645
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Lists all users who recently enabled Out-of-Office along with their latest sign-in activity. SOC analysts can reference this when triaging unfamiliar sign-in or impossible travel alerts to quickly determine if the user is on vacation.
This rule detects successful self-service password reset (SSPR) operations performed by users from IP addresses geolocated to a country that does not match their typical sign-in activity over the past 30 days. This behavior may indicate account takeover where an adversary has compromised credentials and is resetting the password to maintain access or gain further persistence.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
Detects MFA push bombing attacks by identifying a high volume of MFA challenge failures (errorCode 500121) associated with a single user account within a short time window. This activity often indicates an attempt to overwhelm or fatigue a user into inadvertently approving an MFA request.
Detects a high volume of file uploads (greater than 50) to OneDrive or SharePoint by a single user within a 5-minute window, potentially indicating bulk exfiltration of data.
Detects bulk file access, download, or sync operations by a single user account within a 30-minute window in Microsoft SharePoint Online or OneDrive for Business. This behavior is indicative of potential data exfiltration or unauthorized mass collection of sensitive information.
This rule detects potential token theft or MFA bypass by correlating successful MFA-satisfied interactive sign-ins with subsequent non-interactive sign-ins (token refreshes) occurring within a 60-minute window from different IP addresses for the same user. This pattern is indicative of an attacker stealing a session token (e.g., via session cookie theft or AiTM phishing) and using it to authenticate from a different location.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
Detects instances where a user successfully authenticates using Multi-Factor Authentication (MFA) from one location, followed by a Single-Factor Authentication (SFA) logon from a different location within a 10-minute window. This behavior is indicative of potential session hijacking or session cookie theft where an attacker reuses an authenticated session or manipulates the authentication flow to bypass MFA requirements.
Tracks the Kali365 tool iterating through the victim's inbox, performing mass mail item reads or API-driven exports of mailbox contents.
Inbox Rule Notification Suppression
Cortex XDR
Detects the creation or modification of inbox rules designed to hide security and MFA notifications by deleting, marking as read, or moving them to hidden folders. This technique is commonly used post-compromise to suppress alerts about rogue device enrollment, sign-ins, or password changes, preventing the victim from discovering an account takeover. It is a frequent persistence technique in Business Email Compromise (BEC) and Account Takeover (ATO) attacks.
Detects instances where PowerShell is spawned directly from Microsoft Teams processes or via explorer.exe shortly after receiving an external chat message in Teams. This pattern is often associated with social engineering lures, such as the 'paste-and-run' attack chain used to facilitate malicious activity.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects suspicious execution of .scr (screensaver) files, execution of 'SecureMessage' named executables (potentially Pony malware), and email attachments containing .scr or .zip files, which are common vectors for malware delivery.
Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. Specifically, it looks for emails where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' but differs from 'SenderMailFromDomain' (P1 envelope), and the email was successfully delivered.
This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.
Detects anomalous activity where a single user or service principal downloads more than 5 Microsoft Teams meeting recordings within a 1-hour window. This behavior potentially indicates an insider threat or compromised account performing bulk harvesting of sensitive meeting content.
Detects anomalous or suspicious behavior from Microsoft 365 Copilot agents, plugins, or sessions. This includes bulk access to files containing sensitive keywords, unauthorized export or sharing of sensitivity-labeled documents, and high-volume Microsoft Graph API read activity targeting sensitive paths in SharePoint or OneDrive.
Detects Entra ID guest (B2B) users performing a sign-in from a previously unseen IP address or country (observed over the last 30 days), followed within a 4-hour window by sensitive file operations in SharePoint, OneDrive, or Teams (e.g., file downloads, exports, or sensitivity label changes). This pattern is indicative of potential account takeover or unauthorized access to sensitive corporate data.
Detects successful sign-ins using legacy authentication protocols (e.g., IMAP, POP3, SMTP AUTH, ROPC) for user accounts that are in scope of a Conditional Access policy requiring multi-factor authentication (MFA). Legacy protocols do not support modern authentication flows, effectively bypassing configured MFA requirements and increasing the risk of credential-based attacks.
Page 97 of 150