Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
This rule detects attempts to add email delegate permissions via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' with a URI containing 'mailboxSettings'. This activity could indicate an attacker attempting to gain unauthorized access to a user's mailbox by granting delegate access to another account, which is a common persistence technique.
This rule detects emails with subjects related to financial transactions (Invoice, Purchase Order, PO, Payment, Order) that contain attachments with suspicious file extensions (.js, .hta, .vbs). It specifically filters for emails originating from domains not whitelisted as trusted and aggregates the count and average size of such attachments.
This rule detects potential spear phishing campaigns by identifying a high volume of emails (10 or more within an hour) from external senders (not @company.com) that contain keywords like 'password', 'account', or 'security' in the subject line, and also include either an attachment or a URL. This combination of factors suggests a targeted social engineering attempt.
This rule detects potential bulk phishing email campaigns by identifying a high volume of emails originating from external senders (not @company.com) with suspicious subject lines containing keywords like 'action required', 'verify account', or 'confirm identity'. The rule triggers if at least 50 such emails are sent to 20 or more unique recipients within a one-hour window.
This rule detects emails where the sender's address contains keywords like 'paypal', 'amazon', or 'apple' but does not originate from their official domains (e.g., '@paypal.com'). This pattern is indicative of lookalike domain phishing attempts, where attackers try to impersonate legitimate brands to trick recipients.
This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.
This rule detects potential phishing attempts by identifying emails with URLs that originate from outside the internal company domain (@company.com). It specifically looks for emails where the subject line contains keywords like 'click', 'confirm', or 'update', and where multiple such emails (3 or more) are sent from the same external sender to the same recipient.
Detects a successful login from a non-compliant, unmanaged device followed by an inbox rule creation or modification within 10 minutes. This sequence aligns with post-compromise evasion tactics observed in device code phishing campaigns like Kali365, where attackers quickly suppress security alerts after gaining access.
This rule detects attempts to create or modify email forwarding rules in Office 365 via the Microsoft Graph API. Specifically, it looks for HTTP POST requests to the '/mailFolders/inbox/messageRules' endpoint on 'graph.microsoft.com'. This activity can indicate an attacker setting up an inbox rule to forward emails to an external address for data exfiltration or to maintain persistence.
This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
This rule detects the issuance of OAuth tokens or OAuth consent events within cloud applications. It specifically looks for these events where the client application is not 'Microsoft Teams' or 'Azure CLI'. The rule summarizes the number of grants and distinct users for each client application and token ID over hourly intervals. This can help identify potentially unauthorized or suspicious OAuth application consents.
Detects inbound emails with voicemail-themed subjects that pass SPF and DKIM but fail DMARC alignment. This technique is often used to exploit domains with p=none policies and obscure the actual origin of phishing attempts.
Detects Microsoft Teams messages containing links to Pastebin. Threat actors (e.g., Nimbus RAT operators) use Pastebin to host instruction checklists and payload URLs during vishing attacks.
This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.
This rule detects potential phishing attempts by identifying emails with URLs that originate from outside the internal company domain (@company.com). It specifically looks for emails where the subject line contains keywords like 'click', 'confirm', or 'update', and where multiple such emails (3 or more) are sent from the same external sender to the same recipient.
Page 130 of 179