Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
149 detections
Filters
Last updated
All Time
Detection languages
84
20
13
12
8
Contributors
59
14
12
11
10
Categories
75
61
47
34
23
Platforms
125
55
31
15
6
Products / Services
124
27
24
11
8
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects high-frequency, automated polling of Microsoft 365 mailbox data via the Microsoft Graph API, characteristic of malicious inbox scanning tools (e.g., Box Monitor). The rule correlates these persistent access patterns with subsequent searches for high-value financial keywords, identifying potential Business Email Compromise (BEC) reconnaissance.
Detects high-frequency, automated access to mail items via Microsoft Graph API (mail.read/MailItemsAccessed), consistent with automated scanning or exfiltration tools like ARToken's Inbox Monitor. The rule identifies suspicious patterns of repetitive access to mailbox folders or messages that may indicate Business Email Compromise (BEC) or automated credential-based harvesting.
Detects access to Microsoft Graph API endpoints related to mail, contacts, drive, or messages from a device that was registered within the last 24 hours. This behavior may indicate an adversary using stolen session tokens or credentials to access cloud-based email and data shortly after device registration or enrollment.
Detects non-interactive sign-in events to the Microsoft Graph API by applications that are not part of a known set of standard Microsoft applications. This pattern may indicate the use of stolen access tokens or compromised sessions (e.g., via device code phishing) to access M365 data without user interaction.
This rule identifies sustained, low-volume activity (low-and-slow) against Microsoft 365 services (SharePoint, OneDrive, and Exchange) which may indicate an adversary is using automated methods via the Graph API to collect sensitive files or emails over an extended period. The rule buckets events by user and time, requiring a minimum of three hours of activity with consistent but low-volume interactions to identify potential data collection behavior that avoids traditional volume-based detection thresholds.
This rule detects anomalous high-frequency search activity within Microsoft 365 environments targeting sensitive keyword terms like 'invoice', 'payment', 'wire', or 'bank.details'. The detection identifies users performing multiple searches across mailbox or graph activity within a short period, which may indicate account compromise or unauthorized email exfiltration attempts.
Detects anomalous access to email items containing financial keywords (e.g., payroll, invoice, banking) via 'MailItemsAccessed' events, characteristic of potential data collection following an AiTM (Adversary-in-the-Middle) account takeover. The rule identifies accounts accessing multiple financial emails without performing traditional BEC indicators such as creating inbox rules, modifying mailbox forwarding, or sending outbound phishing emails, which helps isolate silent exfiltration attempts.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects browser activity where a user agent navigates to common webmail services (Gmail, Outlook) followed quickly by network traffic to potentially malicious external infrastructure or non-standard endpoints, suggesting unauthorized email content exfiltration.
Detects high-volume access to Microsoft Graph API endpoints related to messages, mail folders, and attachments by a single user account within a 30-minute window. This behavior is indicative of automated, unauthorized email and attachment scraping, often associated with remote email collection attempts.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects the creation or modification of inbox and transport rules in Office 365 that perform automatic email actions such as redirecting, forwarding, deleting, or marking emails as read, especially when targeting keywords related to sensitive information (e.g., invoice, payment, vendor, bank). This behavior is often associated with email account compromise and data exfiltration or persistence strategies.
Detects anomalous, high-volume mailbox access across multiple distinct Exchange Online mailboxes within a short timeframe (1 hour) initiated by a single user account. This behavior is indicative of automated email reconnaissance, content scraping, or bulk exfiltration, often associated with post-credential compromise activity where an attacker iterates through mailboxes to identify sensitive information such as financial or administrative data.
Detects browser activity where a user agent navigates to common webmail services (Gmail, Outlook) followed quickly by network traffic to potentially malicious external infrastructure or non-standard endpoints, suggesting unauthorized email content exfiltration.
Detects anomalous, high-volume email access patterns (more than 200 mail items accessed per hour) by specific Client or Azure AD App IDs, which may indicate automated data collection or exfiltration by an adversary using compromised or unauthorized applications.
Detects anomalous, high-volume email access patterns (more than 200 mail items accessed per hour) by specific Client or Azure AD App IDs, which may indicate automated data collection or exfiltration by an adversary using compromised or unauthorized applications.
Detects high-volume mailbox access (exceeding 50 items) performed by a specific API/Client ID pair associated with known mailbox exfiltration tools. This behavior is indicative of unauthorized automated data collection or harvesting from an Office 365 Exchange environment.
This rule detects potentially malicious outbound email activity sent through Microsoft Graph or Exchange APIs using unknown or infrequently seen client applications. It identifies scenarios where these applications send emails containing financial keywords (e.g., 'invoice', 'wire transfer'), which is a common indicator of Business Email Compromise (BEC) and 'EvilTokens' style mail-vault activity where attackers intercept or inject themselves into existing financial threads.
Page 3 of 8