Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
240 detections
Filters
Last updated
All Time
Detection languages
170
28
17
13
5
Contributors
45
39
35
22
15
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
203
33
24
17
15
Products / Services
207
48
21
17
10
MITRE Techniques
102
81
66
55
53
IDS Classtypes
3
1
1
IDS Protocols
3
1
1
Detects instances where an AI agent invokes sensitive administrative or system tools (shell execution, file writing, network communication, or email sending) shortly after ingesting untrusted external content, in the absence of explicit, logged user instructions for those specific actions. This behavior is a primary indicator of indirect prompt injection attacks aimed at achieving command execution or C2-like behavior.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
Detects a sequence of events starting with a user signing in via the OAuth device code flow, followed immediately by mailbox item enumeration and sending of email. This pattern is characteristic of attackers who use device code phishing to steal tokens, subsequently using those tokens to access mailboxes and send malicious emails from the compromised account.
Detects anomalous outbound email activity from an account that recently performed an OAuth device code sign-in characterized by elevated risk levels. The rule identifies potential token abuse by looking for a high volume of emails with either a significant percentage of external recipients or patterns indicative of bulk mailing, common in phishing campaigns that leverage compromised identities (e.g., EvilTokens).
This query uses Purview IRM telemetry to identify emails with attachments sent to free public domains.
Detects anomalous, high-volume access to Exchange Online via the REST API, potentially indicating programmatic exfiltration of email content. This rule monitors for specific suspicious Application IDs, Account Display Names, or Account Object IDs that exceed a threshold of 500 Exchange REST events, which is characteristic of mass-email collection patterns often seen in cloud-based identity compromises.
Detects the creation or modification of inbox and transport rules in Office 365 that perform automatic email actions such as redirecting, forwarding, deleting, or marking emails as read, especially when targeting keywords related to sensitive information (e.g., invoice, payment, vendor, bank). This behavior is often associated with email account compromise and data exfiltration or persistence strategies.
Detects anomalous activity where AI-enabled browser agents or extensions perform email summarization or access actions without corresponding user UI interaction, subsequently sending or sharing the information to an external recipient address distinct from the mailbox owner.
This query identifies sensitivity-labeled files sent as email attachments to external recipients. The results provide details including the sender, recipient, file name, file path, and device where the file was observed.
This rule detects potentially malicious outbound email activity sent through Microsoft Graph or Exchange APIs using unknown or infrequently seen client applications. It identifies scenarios where these applications send emails containing financial keywords (e.g., 'invoice', 'wire transfer'), which is a common indicator of Business Email Compromise (BEC) and 'EvilTokens' style mail-vault activity where attackers intercept or inject themselves into existing financial threads.
Detects high-volume or multi-mailbox activity in Exchange Online, indicative of automated mailbox collection or unauthorized bulk data access via Graph or REST APIs. The rule monitors for a threshold of operations across multiple mailboxes or high event counts originating from specific API clients.
This rule detects high-volume email bursts sent through third-party bulk email providers where the sender domain exhibits SPF, DKIM, or DMARC alignment failures. This behavior is indicative of mass phishing campaigns, such as those associated with 'Operation DoppelBrand', attempting to bypass email authentication defenses using compromised or unauthorized infrastructure.
Detects outbound email replies concerning invoices or payments sent by a user shortly after performing a device-code authentication flow, indicative of an ARTSender proxy attack where the attacker hijacks an existing email conversation to conduct Business Email Compromise (BEC).
Detects a high volume of outbound emails (more than 20 within a one-hour window) from a single sender containing the subject line 'Payment Transaction Failed Reminder', which is a common pattern for phishing or social engineering campaigns.
No description available.
No description available.
Detects activity from Anthropic network range across multiple event types
Detects activity from Anthropic network range across multiple event types
Detects activity from Anthropic network range across multiple event types
This rule detects high-volume email bursts sent through third-party bulk email providers where the sender domain exhibits SPF, DKIM, or DMARC alignment failures. This behavior is indicative of mass phishing campaigns, such as those associated with 'Operation DoppelBrand', attempting to bypass email authentication defenses using compromised or unauthorized infrastructure.
Detects activity from Anthropic network range across multiple event types
Page 3 of 12