Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
240 detections
Filters
Last updated
All Time
Detection languages
170
28
17
13
5
Contributors
45
39
35
22
15
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
203
33
24
17
15
Products / Services
207
48
21
17
10
MITRE Techniques
102
81
66
55
53
IDS Classtypes
3
1
1
IDS Protocols
3
1
1
This rule detects the creation or modification of inbox rules in Office 365 that involve email forwarding or redirection to external domains. It calculates a risk score based on whether the action occurred outside of typical business hours (08:00-18:00 local time/weekends) and whether the user is performing this action from a previously unseen IP address, which may indicate a compromised account attempting to exfiltrate or redirect emails.
This rule identifies potential mass phishing campaigns by monitoring O365 email activity for high-volume outbound mail from newly registered or observed domains. It specifically flags senders that have no prior historical activity in the last 90 days, have a domain age of less than 30 days, and exhibit a low variation in email subjects across a large volume of recipients, which is characteristic of automated bulk phishing.
Detects the creation or modification of Exchange inbox rules that configure automatic forwarding or redirection of email to external domains. Attackers often use this technique to exfiltrate email data, maintain persistence, or monitor communications.
Detects email bombing attacks via automated subscription signups
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects potential 'reply-all' storm attacks or malicious mass emails sent to large distribution lists within the organization. It identifies emails sent to 50 or more recipients where the subject line contains phrases like 'reply all' or 'all members', originating from an internal company domain. The rule then counts such broadcast emails within one-hour bins to identify unusual activity.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
This rule detects activities associated with the NotDoor malware used by APT28 for email-based exfiltration. It specifically monitors for the creation of staging files in temporary directories, the use of Outlook.exe to establish external SMTP connections on common mail ports, and the transmission of emails to known adversary-controlled addresses.
This rule detects the creation or modification of inbox rules in Office 365 that involve email forwarding or redirection to external domains. It calculates a risk score based on whether the action occurred outside of typical business hours (08:00-18:00 local time/weekends) and whether the user is performing this action from a previously unseen IP address, which may indicate a compromised account attempting to exfiltrate or redirect emails.
This rule identifies potential mass phishing campaigns by monitoring O365 email activity for high-volume outbound mail from newly registered or observed domains. It specifically flags senders that have no prior historical activity in the last 90 days, have a domain age of less than 30 days, and exhibit a low variation in email subjects across a large volume of recipients, which is characteristic of automated bulk phishing.
This rule detects activities associated with the NotDoor malware used by APT28 for email-based exfiltration. It specifically monitors for the creation of staging files in temporary directories, the use of Outlook.exe to establish external SMTP connections on common mail ports, and the transmission of emails to known adversary-controlled addresses.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
This rule detects the outbound transmission of email attachments via SMTP (ports 25 and 587) that contain archived file formats (zip, 7z, tar.gz, tgz). Attackers often compress collected data into archives to facilitate exfiltration and minimize the time required for data transfer.
This rule detects the outbound transmission of email attachments via SMTP (ports 25 and 587) that contain archived file formats (zip, 7z, tar.gz, tgz). Attackers often compress collected data into archives to facilitate exfiltration and minimize the time required for data transfer.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window. This behavior can indicate data exfiltration or collection by an adversary.
Identifies the creation of an Exchange transport rule or mailbox setting that forwards all incoming emails to an external, attacker-controlled address.
This rule detects potential lateral phishing attempts originating from a compromised Microsoft 365 account. It flags outbound internal emails containing payroll-related keywords, such as direct deposit or salary redirection, which are sent to HR or finance departments. This activity is correlated with recent mailbox rule modifications (like transport or inbox rules) by the same user, a technique often used by threat actors to hide communications or exfiltrate data, consistent with identified campaigns like Payroll Pirate.
This rule detects potential business email compromise (BEC) activity where a compromised mailbox is used to send internal phishing emails or fraudulent invoices to financial departments. It identifies emails sent internally with subjects containing keywords like 'Invoice', 'Payment', 'Wire Transfer', or 'Updated Account', and correlates them with email sending events from cloud applications.
Detects the attacker leveraging a stolen token to create or modify inbox rules (e.g., moving emails to RSS Subscriptions or Archive) to hide their activities. This rule specifically looks for actions like 'New-InboxRule' or 'Set-InboxRule' with parameters indicating email manipulation such as 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead'.
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
Page 5 of 12