Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,952
7,270
6,537
3,867
3,651
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule identifies logon attempts on any device within 30 minutes of a user receiving an email categorized as malware, phishing, or spam. It correlates email event data with identity logon events to detect potential compromise scenarios where a user might interact with a malicious email and subsequently log on, possibly indicating a successful initial access or credential compromise.
This rule identifies users who clicked on URLs within emails from a specific sender. It correlates email events, URL information, and URL click events to pinpoint which users interacted with links in emails, particularly useful for tracking responses to potential phishing attempts from a compromised account.
This rule detects outbound email activity, specifically focusing on emails sent outside the organization's domain that include attachments. It identifies the sender, recipient, file type, file name, and file size of these attachments.
This rule detects inbound emails where the sender's domain contains "microsoft" but does not end with "microsoft.com". This is a common tactic used in phishing attacks to spoof legitimate Microsoft domains, tricking recipients into believing the email is from a trusted source.
This rule identifies suspicious email attachments based on their file type (e.g., executables, scripts) or if they exceed a defined size threshold. It aims to detect potential data exfiltration or the delivery of malicious files via email.
This rule identifies and analyzes user interactions with URLs embedded in emails, specifically focusing on emails that are either inbound or intra-organizational. It determines which users clicked on URLs within these emails and provides a summary of this activity. This analysis is particularly useful in security contexts, where understanding user behavior regarding potentially risky links can help in identifying phishing attacks or other malicious activities.
This detection identifies repeated outbound email events where large files are sent multiple times within a specific time window. It helps uncover potential data exfiltration attempts or misuse of corporate email for transferring large files externally.
Thresholds for file size, frequency, and time window can be adjusted to fit organizational context.
Thresholds for file size, frequency, and time window can be adjusted to fit organizational context.
This rule detects outbound automatic reply emails sent from an organization's users to external recipients. It specifically looks for emails with subjects starting with "Automatic reply:" that have been delivered and are outbound.
Detects indicators of compromise (IOCs) and suspicious OAuth consent activity
linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft
OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft
OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
Hunts for Office 365 emails that contain URLs of popular Monero exchanges or keywords related to Monero wallet addresses. This could indicate phishing attempts, scams, or other illicit activities.
This rule detects attempts to disable Multi-Factor Authentication (MFA) within Microsoft 365 services. Specifically, it looks for audit log entries containing the operation 'Disable Strong Authentication.' This action could be performed by an attacker to maintain persistent access to compromised accounts by removing an important security layer.
Possible compromise of Microsoft 365 account {{RecipientEmailAddress}} following a device code phishing campaign leveraging microsoft.com/devicelogin to obtain OAuth tokens from an attacker-controlled session.
Detects the addition of a new Federated Domain within Microsoft 365 audit logs. This activity can be a legitimate administrative action but also indicates potential federated credential abuse or the establishment of a backdoor via federated identities.
This rule detects the upload of files to cloud storage services that are known to be used for data exfiltration or are associated with suspicious tunneling activities. It leverages a list of suspicious domains (LOTTunnels) to identify potentially malicious file uploads.
Detects reconnaissance activity associated with the exploitation of SharePoint vulnerabilities (CVE-2025-53770, CVE-2025-53771, etc.). Attackers send a specific HTTP POST request to ToolPane.aspx to probe for vulnerable servers.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration).
The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
This rule detects an impersonation event within Microsoft Teams, specifically when the 'TeamsImpersonationDetected' action type is logged. It extracts the User ID and the Sender's User Principal Name (UPN) associated with the detected impersonation.
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
This rule detects instances where an email with identified threats (e.g., malware, phishing) is received and a URL within that email is subsequently clicked by a user. It correlates email threat information with URL click events to identify successful user interaction with malicious links.
This rule detects instances where a user clicks on a URL within an email, and subsequently, the email is moved to quarantine. This sequence of events suggests that the email was initially delivered, a user interacted with a potentially malicious link, and then a post-delivery security action (quarantine) was taken, indicating a delayed detection of a threat, likely phishing or malware.
This rule detects email events that have an identified threat name and are associated with a URL click event. This combination suggests a user has clicked on a malicious link delivered via email.
Page 121 of 150