Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
234 detections
Filters
Last updated
All Time
Detection languages
147
31
27
9
7
Contributors
56
43
24
19
15
Categories
89
80
79
56
43
Platforms
181
77
51
45
7
Products / Services
182
34
19
16
15
MITRE Techniques
18,116
15,636
12,583
8,393
6,224
CVEs
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-volume access to Microsoft Graph API endpoints related to messages, mail folders, and attachments by a single user account within a 30-minute window. This behavior is indicative of automated, unauthorized email and attachment scraping, often associated with remote email collection attempts.
Detects anomalous, high-volume access to Exchange Online via the REST API, potentially indicating programmatic exfiltration of email content. This rule monitors for specific suspicious Application IDs, Account Display Names, or Account Object IDs that exceed a threshold of 500 Exchange REST events, which is characteristic of mass-email collection patterns often seen in cloud-based identity compromises.
This rule detects high-volume usage (500+ events per hour) of Microsoft Exchange Online resources by accounts that lack an associated AccountObjectId but utilize a TokenObjectId. This pattern is indicative of service accounts or potentially compromised tokens performing bulk actions, such as mass email access or data collection within the Exchange environment.
This rule detects anomalous behavior where an identity performs multi-category discovery (e.g., users, groups, directory roles, applications) via Microsoft Graph API within a single session, followed by intensive collection of content (files, attachments, or messages). This sequence is indicative of an adversary performing reconnaissance to map an environment before moving to data exfiltration or theft.
Detects high-volume, sustained or burst-like access, download, or deletion activity by a single user across SharePoint, OneDrive, or Exchange services. This behavior is indicative of potential data staging, exfiltration, or bulk malicious activity by a compromised account or insider.
Detects anomalous activity where AI-enabled browser agents or extensions perform email summarization or access actions without corresponding user UI interaction, subsequently sending or sharing the information to an external recipient address distinct from the mailbox owner.
Detects high-volume mailbox access (exceeding 50 items) performed by a specific API/Client ID pair associated with known mailbox exfiltration tools. This behavior is indicative of unauthorized automated data collection or harvesting from an Office 365 Exchange environment.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects cloud data access or file download operations in Microsoft 365 (SharePoint, OneDrive, Exchange) performed by a user agent string associated with the python-httpx library. This pattern is often indicative of automated data exfiltration using custom scripts.
This rule detects anomalous, high-volume file and email access events by a single user from a single IP address within the Microsoft 365 environment. The detection logic groups operations such as file downloads, file access, and mailbox item access, flagging instances where a user performs 100 or more such operations, which may indicate data exfiltration or compromised account activity.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects Microsoft 365 MailItemsAccessed events where the email subject or body contains finance-related keywords such as 'invoice', 'payment', 'bank details', or 'wire'. This activity may indicate malicious mailbox scanning or data collection, often associated with unauthorized access or automated enumeration tools like the ARToken Inbox Monitor.
Detects automated mailbox access operations such as 'MailItemsAccessed' or 'Search-Mailbox' that are filtered by specific, high-risk financial or Business Email Compromise (BEC) keywords in the email subject line. This behavior is indicative of an automated 'inbox-monitor' style attack, where a compromised OAuth token is used to systematically scrape mailboxes for sensitive financial data.
Detects usage of the 'One Outlook Web' application (ApplicationId 20893) to access Microsoft 365 Exchange REST APIs. This activity is a potential precursor to high-volume mailbox data exfiltration and should be monitored for volumetric anomalies.
Detects instances where identified AI agents, bots, or automated assistants perform bulk access operations on mailboxes (e.g., MailItemsAccessed, Send, deletions) or data stores (e.g., FileDownloaded, FileAccessed, SearchQueryPerformed) in Microsoft 365 environments. This monitors for potentially compromised or malicious AI service accounts abusing legitimate access to harvest sensitive data.
Detects anomalous high-volume access to Exchange Online via the One Outlook Web/Office client, potentially indicating data exfiltration or automated mass email access by a compromised account.
This rule detects potentially malicious or automated data access patterns within Microsoft 365 or similar cloud environments. It identifies user accounts or applications that exhibit a high volume of file/email access operations across a diverse set of paths, which is often indicative of automated data exfiltration, scraping, or suspicious collection by a compromised identity.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Page 3 of 12