Dulitha Wickramasinghe
@dulitha99Completionist
0 followers1 download84 copies1 like521 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
1
1
Platforms
2
2
Products / Services
2
2
MITRE Techniques
1
1
1
1
1
IDS Classtypes
2
IDS Protocols
1
Detects high-confidence phishing emails that were successfully delivered to user inboxes or folders instead of being quarantined, where the message is identified as first contact and not explicitly allowed through user-level safe sender/domain overrides. The query enriches the email data with URL click telemetry from UrlClickEvents, allowing visibility into whether embedded URLs were clicked or not clicked, who clicked them, and when the click occurred. This detection is intended to identify potentially malicious phishing emails that bypassed preventive controls and provide recipient-level click insight to support triage, impact assessment, and response actions.
Detects successful Microsoft Entra ID sign-ins originating from geographically distant locations within a short time period where the calculated travel speed exceeds realistic human travel limits (>900 km/h). The detection correlates consecutive sign-ins for the same user and identifies potential account compromise by validating device identifiers and trust attributes. Alerts are generated when a user authenticates from different countries, exceeds configured distance and speed thresholds, and uses a different or unknown device.
This rule detects a high volume (50 or more) of failed authenticated SMTP login attempts to Office 365 Exchange Online from a single IP address within a 24-hour period. The failures are specifically for error codes 50126 (invalid username or password) or 50053 (account locked). This pattern is indicative of a brute-force or password-guessing attack against Exchange Online accounts.