Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects hard deletion of mailbox data to remove forensic email evidence
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
Detects bulk downloading of SharePoint document libraries
This rule detects when an OAuth application is granted tenant-wide administrative permissions within a Microsoft 365 environment. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing 'oauth2PermissionGrants'. This activity is indicative of a malicious OAuth app attempting to gain broad access to an organization's data and resources, often as a persistence mechanism.
This rule detects multiple failed sign-in attempts using the 'Device Code' authentication flow from various IP addresses or locations for a single user. This behavior can indicate an adversary attempting to bypass multi-factor authentication (MFA) or gain unauthorized access through device code phishing or brute-force attacks against the device code flow. The rule specifically looks for more than 3 attempts from more than 2 distinct IP addresses or locations, targeting common Microsoft applications like Office, Teams, Azure Portal, or Graph.
Identifies inbound emails claiming to be from an internal domain where the sender IP does not match the expected authorized third-party MX record or spam filter IP addresses. This rule focuses on emails successfully delivered to the user, where the sender domain claims to be one of the organization's internal domains, and the sending IP is not among the expected external MX or spam filter IP addresses.
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
Detects the creation of a new Global Administrator or Company Administrator account, which may occur after an attacker compromises an Intune administrator to establish persistence and cement full control over the tenant.
Detects creation of inbox rules to hide attacker communications from victim
This rule detects potential direct send email spoofing attempts where an email fails SPF, DKIM, and DMARC authentication checks, but passes Composite Authentication (CompAuth). Additionally, it looks for emails where the sender's local part (username before the @) matches the recipient's local part, suggesting an attempt to impersonate an internal user. The rule also filters out emails that were blocked and those sent via internal connectors, focusing on external spoofing attempts. It further excludes emails originating from specific countries (New Zealand, Australia) which can be customized.
This detection identifies when an email that contains a URL associated with a known Remote Monitoring and Management (RMM) tool was sent and subsequently clicked by the intended recipient or the original sender. The domain is not part of the organization's approved RMM solutions, indicating a potential use of Living-off-the-Land RMM (LOLRMM) techniques often employed in initial access or persistence stages by threat actors.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
Detects inbound external emails where the sender's display name exactly matches the recipient's display name. This is a common social engineering tactic used to create a false sense of familiarity, making the recipient more likely to trust the email and its contents. The rule specifically excludes legitimate self-sent emails where the sender's and recipient's email addresses also match.
This rule identifies suspicious activity within Microsoft Intune by focusing on sensitive operations, broad assignments, and actions performed by API actors (Service Principals) without an associated human User Principal Name (UPN). It specifically looks for operations like creating, adding, assigning, or updating DeviceManagementScripts, DeviceShellScripts, Win32LobApp, DeviceConfiguration, DeviceCompliancePolicy, EndpointSecurity, SecurityBaseline, ConfigurationPolicies, or GroupPolicyConfigurations. The rule also flags broad assignments targeting 'All Devices', 'All Users', 'allDevices', or 'allLicensedUsers'. The primary goal is to detect potential abuse of over-permissioned Graph API applications by attackers to bypass MFA and deploy malicious Mobile Device Management (MDM) commands or configurations.
Detects assignment of highly privileged directory roles in Azure AD, including
Global Administrator and Privileged Role Administrator.
Global Administrator and Privileged Role Administrator.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects deletion of MFA configurations to enable authentication bypass
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
This rule detects when multiple versions of files are deleted within SharePoint by a single user. This could indicate an attempt to remove historical data or cover tracks.
Page 126 of 179