Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
240 detections
Filters
Last updated
All Time
Detection languages
170
28
17
13
5
Contributors
45
39
35
22
15
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
203
33
24
17
15
Products / Services
207
48
21
17
10
MITRE Techniques
102
81
66
55
53
IDS Classtypes
3
1
1
IDS Protocols
3
1
1
This rule detects potential malicious activity where a single sender local-part (username) is observed sending emails across multiple, disparate, and likely compromised domains (such as cPanel or WordPress sites). This behavior is characteristic of large-scale phishing campaigns where a single attacker controls multiple compromised mail relays.
This rule detects potential data exfiltration by correlating access to files labeled as sensitive (confidential, restricted, etc.) with a subsequent upload to a personal cloud storage provider or transmission via email to a personal domain within a two-hour window.
The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour).
This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity.
This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.
This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity.
This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.
Detects anomalous outbound email activity from an account that recently performed an OAuth device code sign-in characterized by elevated risk levels. The rule identifies potential token abuse by looking for a high volume of emails with either a significant percentage of external recipients or patterns indicative of bulk mailing, common in phishing campaigns that leverage compromised identities (e.g., EvilTokens).
Detects the creation or modification of Microsoft 365/Exchange inbox rules that suggest malicious staging or exfiltration activities. This includes rules configured for external email auto-forwarding, automatic deletion of messages, or movement of emails into hidden/system folders (e.g., RSS Subscriptions, Archive) which may be filtered based on sensitive keywords related to financial or credential theft (e.g., invoice, wire, payment).
Detects bulk mailbox export or content search operations performed by an identity shortly after a high-risk sign-in event. This pattern is indicative of potential account takeover where an adversary attempts to harvest sensitive email data at scale for BEC or extortion.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour).
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
Detects the creation of inbox rules (e.g., move, delete, stop processing) on M365 accounts, followed by the transmission of emails with subjects related to 'direct deposit'. This pattern is frequently observed in Business Email Compromise (BEC) campaigns where attackers automate the concealment or exfiltration of sensitive payroll-related communications.
Detects emails that appear to have been injected or sent using the 'swaks' SMTP testing tool rather than a standard Mail User Agent (MUA). The rule identifies this activity by looking for the 'swaks' signature in the 'X-Mailer' header or by matching a specific 'Message-Id' pattern typical of swaks.
Detects anomalous outbound email activity from an account that recently performed an OAuth device code sign-in characterized by elevated risk levels. The rule identifies potential token abuse by looking for a high volume of emails with either a significant percentage of external recipients or patterns indicative of bulk mailing, common in phishing campaigns that leverage compromised identities (e.g., EvilTokens).
This rule monitors for suspicious network traffic to SMTP services and specific external email addresses, as well as process command lines containing these indicators. Additionally, it tracks email events involving specific sender, recipient, and subject indicators which may be indicative of unauthorized communication or data exfiltration attempts.
This rule detects the creation or modification of Exchange mailbox rules (Forward, Redirect, Delete, or Mark as Read) involving sensitive keywords (invoice, wire, payment, finance, remittance) shortly after an anomalous sign-in event or a password reset on the same account. This combination is a strong indicator of account takeover and mailbox persistence.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
Detects instances where browser extensions, potentially AI-assisted (e.g., Claude, Gemini), trigger automated mail actions (send, forward, summarize) to non-standard, external domains. This behavior may indicate an unauthorized agent attempting to exfiltrate or manipulate email content.
Detects anomalous outbound email activity from an account that recently performed an OAuth device code sign-in characterized by elevated risk levels. The rule identifies potential token abuse by looking for a high volume of emails with either a significant percentage of external recipients or patterns indicative of bulk mailing, common in phishing campaigns that leverage compromised identities (e.g., EvilTokens).
Detects anomalous outbound email activity from an account that recently performed an OAuth device code sign-in characterized by elevated risk levels. The rule identifies potential token abuse by looking for a high volume of emails with either a significant percentage of external recipients or patterns indicative of bulk mailing, common in phishing campaigns that leverage compromised identities (e.g., EvilTokens).
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Page 2 of 12