Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
240 detections
Filters
Last updated
All Time
Detection languages
170
28
17
13
5
Contributors
45
39
35
22
15
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
203
33
24
17
15
Products / Services
207
48
21
17
10
MITRE Techniques
102
81
66
55
53
IDS Classtypes
3
1
1
IDS Protocols
3
1
1
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
Detects a newly replayed session issuing mailbox searches for invoice, payment, password, security, or confidential terms. This rule is designed to identify suspicious activity indicative of session hijacking or credential compromise, where an attacker uses a replayed session to search for sensitive information within a mailbox or SharePoint.
Detects outbound email from an organizational mailbox to a common consumer email provider with multiple or large attachments. This could indicate data exfiltration or unauthorized transfer of sensitive information.
Detects a mail forwarding or redirect rule created from a session that recently exhibited token replay or unusual client changes. This rule specifically looks for operations related to Inbox Rules in Exchange or Office 365 audit logs that contain keywords indicating forwarding or redirection.
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
Detects administrative mail, forwarding, or content compliance rule changes performed from an IP address classified as an anonymous proxy. This behavior is often associated with threat actors like UNC6508, who use obfuscation networks and proxies to access administrator accounts and exfiltrate data.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
Detects an administrative forwarding, redirect, BCC, or content compliance rule change when Defender for Cloud Apps identifies attributes that are uncommon for the account. UNC6508 replayed harvested credentials to access an administrator account before creating its covert exfiltration rule. The anomaly requirement increases confidence while preserving coverage for infrastructure that is not recognised as a proxy.
Detects internal spearphishing emails used to spread within an organization
Detects a sender transmitting many attachment-bearing messages or a large aggregate attachment volume to external recipients within thirty minutes. This could indicate data exfiltration or a compromised account being used to send spam or malware.
Detects an administrative content rule that combines strategic research or defence collection terms with an external BCC, forward, or redirect destination. GTIG reported that the Patroit rule matched subjects related to medical research, Chikungunya, artificial intelligence, cyber programmes, Indo-Pacific operations, defence, and uncrewed systems before silently forwarding the messages.
Detects hard deletion of mailbox data to remove forensic email evidence
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects a high volume of outbound emails originating from an internal Exchange server to external addresses with spoofed headers, indicating an Open Relay exploit.
Detects hard deletion of mailbox data to remove forensic email evidence
This rule detects an outbound email bombing campaign by monitoring TCP connections to port 25 (SMTP). It triggers an alert if a single source IP address initiates 200 or more established connections to port 25 within a 60-second window. This high volume of outbound email connections from a single source is indicative of an attempt to overwhelm an email server or recipient with a large number of emails, often associated with denial-of-service attacks.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.
This rule detects suspicious activity where a user successfully performs a multi-factor authentication (MFA) device login to Microsoft Office 365 via a browser, and within a 15-minute window, the same user either creates a new inbox rule or adds a new device. This combination of events could indicate an adversary gaining initial access and then setting up persistence (e.g., forwarding emails) or further device enrollment.
Page 6 of 12