Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
https://www.kaseya.com/blog/dkim-replay-attacks-apple-paypal-invoice-abuse/
This rule detects emails delivered to an inbox that contain URLs identified as malicious by OpenPhish, indicating a successful phishing attempt or delivery of a known malicious link.
This rule detects instances where users click on URLs from emails that impersonate 'DocMagic'. It specifically looks for emails with 'docmagic' in the sender display name or address, extracts URLs from these emails, and then identifies if any of these URLs were subsequently clicked by users. This indicates a potential successful phishing attempt related to the DocMagic impersonation campaign.
Detects anomalous Exchange Transport Rule activity: high volume changes, suspicious patterns, or after-hours modifications
Detects file access or download activity from SharePoint or OneDrive where the user agent is PowerShell. This TTP has been associated with UNC6671 (related to ShinyHunters) for data exfiltration from SaaS applications.
This rule detects potential phishing activity by identifying inbound emails from specific sender addresses that were not blocked by Microsoft Defender for Office (MDO), followed by network connections to a known malicious infrastructure associated with 'Tycoon2FA'. The rule first looks for unblocked emails from 'donotreply@docmagic.com' and 'noreply@frigoarrobba.com.br'. If such emails are found, it then checks for network connections to 'listener.facraivo.sa.com' within a 7-day window, indicating a potential compromise or user interaction with the phishing attempt.
Detects network connections to the Microsoft Graph API (graph.microsoft.com) from processes that are not common Microsoft Office applications. Threat actors, such as those behind the FINALDRAFT malware, have been observed using the Graph API for covert command and control (C2) communications, often by manipulating email drafts to send and receive commands. This allows them to blend their traffic with legitimate enterprise activity.
Detects file access or download operations from Microsoft SharePoint Online where the User-Agent string indicates the use of PowerShell. This behavior has been observed in campaigns by threat groups for bulk data exfiltration.
This query hunts for inbound emails that contain URLs embedded in QR codes and originate from senders that are not commonly observed in the environment, a common technique used in QR-based phishing campaigns.
This query hunts for network activity and other events related to specific domains (freefoodaid.com, wellnessmedcare.org) potentially associated with CVE-2026-21509. It searches DNS queries, network connections, generic web proxy/firewall logs, and URL click events to identify interactions with these domains.
This rule detects Microsoft Teams chat or call activity initiated by external users whose domains are not present in a pre-defined whitelist. It specifically looks for 'ChatCreated' or 'CallParticipantDetail' actions from external users and filters out activity from known, whitelisted external domains. This can help identify potentially unauthorized or suspicious external communication within Microsoft Teams.
This query parses the complex JSON parameters of the New-TransportRule and Set-TransportRule commands to find instances where email is being secretly copied externally or security is being lowered.
This query uses the Machine Learning series_decompose_anomalies function to build a baseline of "normal" transport rule modification behavior. If your organization typically changes 0 rules a week, and suddenly 5 are changed at 2 AM on a Saturday, this query will catch it regardless of what the parameters are.
This rule detects chat or call activity by external users in Microsoft Teams whose source tenant is not present in a pre-defined whitelist. This could indicate unauthorized external communication or potential data exfiltration attempts.
This KQL check for email links that were clicked/ email attachment that were opened before recall
Detects emails containing threat-actor lure links to trojanized ScreenConnect MSI files, specifically targeting 'cld.pt' downloads with 'COMPROBANTE*.msi' patterns. The rule also looks for 'COMPROBANTE' keywords in email subjects as a fallback.
This rule detects instances where a SharePoint or OneDrive file/folder is shared with a guest user whose email address is identified as a threat intelligence indicator. This could indicate an attempt to exfiltrate data to a known malicious entity or an account compromise being used for data staging.
Detects when a suspicious process (such as a script interpreter or LOLBIN) is executed from a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious executables or scripts in these locations to bypass security controls and execute them, often as a result of a user opening a malicious document.
This rule detects a multi-stage attack chain starting with a high-confidence phishing email, followed by a risky sign-in from the recipient, and culminating in sensitive actions within Azure, specifically targeting IAM role assignments, storage account key access, or AKS cluster modifications. The detection correlates these events within a defined time window to identify potential compromise of cloud resources originating from a successful phishing attack.
This rule tracks and deduplicates alert emails from a Managed Security Service Provider (MSSP). It identifies emails from a specific sender, filters by subject keywords (e.g., severity levels), and groups them into sessions to prevent duplicate alerts. It also extracts case numbers from portal URLs found within the emails.
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of unique mailboxes belonging to other users. 2) Identifies users accessing a high number of unique folders within another user's mailbox. Both scenarios can indicate unauthorized access, data exfiltration attempts, or compromised accounts.
Page 139 of 179