Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,960
7,270
6,537
3,867
3,651
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.
Detects successful Microsoft 365 user authentications where Conditional Access (CA) policies were bypassed, resulting in single-factor authentication. This pattern is indicative of attackers using compromised edge network appliances—which are often configured as trusted network locations—to proxy authentication requests and circumvent security controls.
Detects a sequence of events within a 30-minute window for a single user, specifically capturing MFA configuration changes (reset/enrollment), authentication, and device registration, occurring outside of typical business hours (20:00 - 06:00). This behavioral pattern is often indicative of an adversary establishing persistence or account takeover after gaining access to a valid account.
This rule detects potential enumeration of ServiceNow API endpoints or unauthorized access attempts from a known malicious IP address. It monitors HTTP header events specifically for common ServiceNow API patterns, aggregating requests to identify high-volume activity or interactions with sensitive endpoints like 'related_list_edit'.
Detects signs of Adversary-in-the-Middle (AiTM) phishing where a login attempt produces a reprocess error (50199) or result code 90014, immediately followed by suspicious activity using specific Firefox user-agent versions known to be associated with Tycoon 2FA reverse proxy session token capture tools.
Detects log entries related to sensitive HR and financial data modifications, specifically identifying keywords such as 'Workday', 'direct deposit', 'payment election', or 'bank account' changes. This activity is indicative of potential payroll fraud, where an adversary attempts to redirect employee compensation to an unauthorized account.
Detects the addition of users to specific high-value or sensitive groups in Microsoft Entra ID (Azure AD), which could indicate potential unauthorized privilege escalation or persistence attempts by an attacker.
Detects anomalous bulk GET requests directed at Cisco SD-WAN (vManage) REST API endpoints, specifically targeting topology information, device lists, and configuration templates. This pattern of activity is indicative of reconnaissance or exfiltration attempts against the SD-WAN fabric management interface.
This rule detects suspicious activity within Microsoft Graph API where an account is querying mailbox contents for sensitive payroll and HR-related keywords. This pattern is often observed following an Adversary-in-the-Middle (AiTM) session compromise, where threat actors (such as those associated with the Payroll Pirate campaign) leverage stolen session tokens to exfiltrate sensitive employee information by searching for specific financial and payroll keywords across multiple mailboxes.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com. This indicates that the attacker's backend successfully returned 'status:completed' and the phishing kit executed a window.location.replace to redirect the victim to OneDrive after token capture.
Detects users who modify their MFA settings (registration/update/delete) and subsequently perform privileged actions (such as adding role members or service principal credentials) within a short timeframe, while simultaneously observed active in communication applications like Teams, Zoom, or Webex. This behavior is indicative of potential account takeover where an adversary modifies authentication methods to gain persistent access, followed by privilege escalation.
Detects a successful authentication event (including MFA success) immediately followed by another successful authentication for the same user account from a different IP address or user agent, within a 10-minute window. This behavioral pattern is often indicative of session hijacking or adversary-in-the-middle (AiTM) phishing attacks where an attacker reuses a session token obtained from a victim.
Detects automated post-compromise activity associated with Bluekit Browser-in-the-Middle (BitM) attacks. The rule identifies a pattern of a successful user login followed rapidly (within 10 minutes) by a password change and new passkey enrollment, indicating an adversary is securing their persistence after initial session hijacking.
Detects the creation or modification of Power Automate Flows that utilize non-Microsoft domains for HTTP or webhook connectors. Adversaries may abuse Power Automate to automate exfiltration or command-and-control tasks by connecting workflows to external malicious endpoints.
Detects bulk file access, download, or sync operations by a single user account within a 30-minute window in Microsoft SharePoint Online or OneDrive for Business. This behavior is indicative of potential data exfiltration or unauthorized mass collection of sensitive information.
This rule detects when a user grants an OAuth application consent to access high-privilege scopes in an Azure environment. It specifically flags instances where the consent is not for all principals and the user performing the action is not a Global Administrator, which may indicate an attacker-controlled application being granted access to sensitive data or resources.
This rule detects when a user grants an OAuth application consent to access high-privilege scopes in an Azure environment. It specifically flags instances where the consent is not for all principals and the user performing the action is not a Global Administrator, which may indicate an attacker-controlled application being granted access to sensitive data or resources.
This rule detects potential phishing attempts by identifying emails with subject lines and attachment names related to Income Tax or official tax filings. The detection logic correlates indicators such as specific tax-related subject phrases, common tax utility attachments, suspicious URLs (govtop.one), and sender spoofing (impersonating 'Government of India' without a valid .gov.in domain).
Detects HTTP requests to Microsoft 365 search endpoints containing unusually long query strings. Such patterns may indicate automated data extraction, exfiltration over alternative protocols, or unauthorized information harvesting via search parameters.
This rule detects potentially malicious search queries within Microsoft 365 or Copilot-related URLs intercepted by email gateways, proxies, or SIEM sources. It monitors for suspicious query parameters that may indicate attempts to hide malicious content, such as HTML tags (e.g., <img>), image-related keywords, or excessively long query strings, which could be indicative of phishing attempts or browser-based exploitation techniques.
Detects the SearchLeak (CVE-2026-42824) exploit, where an attacker uses a prompt-injected M365 Copilot URL to force the assistant to search the victim's mailbox for sensitive authentication information such as MFA codes, OTPs, or security passcodes. The rule correlates an external HTTP request containing the malicious URL with a subsequent Exchange search query initiated by the Copilot service within a 2-minute window.
Page 105 of 142