Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Tracks AAD/Exchange logs showing mail routed through an external tenant specifically to bypass internal domain spoofing filters via trusted connectors. This rule identifies emails where the sender's domain matches the internal company domain, but the email was routed through an external Office 365 connector and did not originate from a trusted internal IP address, indicating a potential cross-tenant spoofing attempt.
Detects a compromised account performing heavy Graph API searches for HR personnel to socially engineer IT/Helpdesk. Specifically, it looks for search queries containing terms like 'HR', 'Human Resources', or 'Payroll Manager'.
Identifies emails where the From header spoofing a government entity mismatches the envelope sender in MailEvents. This indicates a potential email spoofing attempt, often used in phishing campaigns.
Detects the creation or modification of an inbox rule in Microsoft 365 where the rule's name consists entirely of special characters. This behavior can be indicative of an adversary attempting to evade detection by obscuring malicious inbox rules.
Detects Tycoon 2FA operator recon assessing mailbox forwarding rules, auto-replies, and timezones. This KQL query identifies actions related to 'mailboxSettings' within 'Microsoft Graph' events, which can indicate an adversary enumerating user mailbox configurations.
Detects incoming phishing emails leveraging Scotiabank and Interac branding for Telephone Oriented Attack Delivery (TOAD). These emails utilize HTML attachments or body content containing specific toll-free numbers (1-800-472-6) and financial lures related to unauthorized Interac e-Transfers, aiming to deceive recipients into initiating a callback.
Detects a spear-phishing email masquerading as AWS Support services originating from a specific compromised university account (awsservices@presby.edu). This rule identifies malicious emails associated with the PoisonSeeds AiTM (Adversary-in-the-Middle) phishing campaign, which uses support ticket lures to harvest credentials.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Identifies email attachments with a specific naming convention ('Agreement Settlement [Target] May [Day], 2026.pdf') used in a credential harvesting campaign. This rule looks for PDF files starting with 'Agreement Settlement' and ending with '.pdf', with a specific date format for May 2026.
Detects inbound spearphishing emails impersonating Scotiabank with Interac e-Transfer financial urgency lures targeting executive/VIP mailboxes from first-time external senders, with multiple variants delivered within one hour.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
Detects an administrative forwarding, redirect, BCC, or content compliance rule change when Defender for Cloud Apps identifies attributes that are uncommon for the account. UNC6508 replayed harvested credentials to access an administrator account before creating its covert exfiltration rule. The anomaly requirement increases confidence while preserving coverage for infrastructure that is not recognised as a proxy.
Detects bursts of Microsoft Graph API calls hitting multiple distinct reconnaissance endpoints within a 60-second window. This behavior can indicate an adversary performing rapid enumeration or discovery within a Microsoft 365 environment.
Detects Graph API queries targeting getResourceTenants, identifying lateral movement preparation. This activity can be indicative of an adversary attempting to enumerate tenant relationships within Microsoft Graph to understand the environment and potentially identify targets for further compromise or lateral movement.
Detects device code authentication via Microsoft Authentication Broker targeting Microsoft Graph, which is a known indicator of Adversary-in-the-Middle (AiTM) attacks or device code phishing.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects inbound email events that impersonate Scotiabank, contain financial urgency lures related to Interac e-Transfers, and include suspicious HTML attachments or .eml files. The rule specifically looks for HTML attachments or .eml files with specific naming conventions ('v-mail_' prefix or '.mp3.eml' suffix) and a file size between 7KB and 8KB, or any HTML attachment. It also checks for sender display name impersonation of Scotiabank while the sender's actual domain is not scotiabank.com.
Detects inbound emails containing links to the Upflow.io billing portal that include an embedded token parameter. This technique is actively abused by attackers to grant unauthorized viewing access to fraudulent invoices without requiring login credentials.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
Detects inbound messages whose subject closely matches the campaign's reported stolen client data extortion wording. The rule looks for specific keywords like 'lost', 'confidential', 'data', 'clients' (all present) and 'very important', 'important', 'client data' (any present) in the email subject, specifically for inbound emails that are either the first contact or have no threat types identified.
This rule detects email events where the sender's domain fails basic DNS resolution, indicating it might be non-existent or invalid, but the email successfully bypasses authentication due to SPF macros. This could be an attempt to spoof emails from non-existent domains while still appearing legitimate to email authentication checks.
Page 123 of 179