Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
234 detections
Filters
Last updated
All Time
Detection languages
147
31
27
9
7
Contributors
56
43
24
19
15
Categories
89
80
79
56
43
Platforms
181
77
51
45
7
Products / Services
182
34
19
16
15
MITRE Techniques
18,116
15,636
12,583
8,393
6,224
CVEs
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
Identifies potentially suspicious email forwarding configurations, mailbox permission assignments, transport rule changes, and delegate access grants that could enable unauthorized email access or data exfiltration.
The query correlates multiple Microsoft 365 audit activities including:
Inbox forwarding rules
SMTP mailbox forwarding
Transport rule forwarding
Delegate mailbox access assignments
Removed or disabled forwarding configurations
This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
The query correlates multiple Microsoft 365 audit activities including:
Inbox forwarding rules
SMTP mailbox forwarding
Transport rule forwarding
Delegate mailbox access assignments
Removed or disabled forwarding configurations
This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
Detects file access events targeting the Mozilla Thunderbird profile directory on Windows systems, which may indicate unauthorized collection or theft of local email data, archives, and account configuration files.
This rule detects potentially malicious mailbox search and item access activity in Microsoft 365. It monitors for users who trigger both 'Search' and 'MailItemsAccessed' actions within a one-hour window. The detection logic flags behavior that includes a high volume of mail access (more than 10 events) or access originating from multiple distinct IP addresses, which are common indicators of automated collection or credential compromise.
This rule detects processes initiating network connections to standard POP3 (110, 995) and IMAP (143, 993) ports that are not identified as trusted, well-known mail clients. By filtering out connections from common email application paths and local IP ranges, it aims to identify potentially malicious processes, scripts, or non-standard tools attempting to perform email collection or exfiltration directly from mail servers.
This rule detects high-frequency, potentially malicious network connections to external infrastructure using unencrypted legacy mail protocols (SMTP: 25, POP3: 110, IMAP: 143). This pattern is consistent with an adversary-in-the-middle (AiTM) attack, where an attacker intercepts email traffic—often following DNS hijacking—to relay and potentially decrypt or harvest credentials and session tokens from plaintext sessions.
Detects anomalous mailbox activity in Microsoft 365 where a user account performs both search operations and mail item access, particularly when the activity originates from multiple IP addresses or exceeds a threshold of mail items accessed within a one-hour window. This behavior often indicates potential mailbox compromise or unauthorized data collection.
This KQL detects possible impossible travel sign-in patterns by identifying users who had successful Entra ID sign-ins from different countries within a short time window of 4 hours.
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects specific user-initiated HTTP requests that contain suspicious prompts, such as requests for lists of names or email formats. This behavior is often associated with reconnaissance or data collection activities, potentially related to social engineering or phishing preparations.
Detects instances where users grant broad permissions (e.g., Mail.Read, Files.ReadWrite) to newly registered or unknown applications. It specifically correlates these grants with device code flow authentication, a technique frequently used in OAuth consent phishing to bypass traditional authentication hurdles.
Detects the creation or modification of inbox rules that forward or redirect emails to another recipient. This can be an indicator of an adversary attempting to exfiltrate emails or maintain persistence.
This rule detects potential brute force attacks against Microsoft Exchange Outlook Web App (OWA) by monitoring for a high volume of 401 Unauthorized status codes from non-internal IP addresses. It also correlates these authentication events with subsequent post-authentication actions, specifically identifying mailbox logins followed by mailbox searching or export requests, which may indicate account compromise and unauthorized data collection or exfiltration.
Page 5 of 12