Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects outbound email activity, specifically focusing on emails sent outside the organization's domain that include attachments. It identifies the sender, recipient, file type, file name, and file size of these attachments.
This rule detects inbound emails where the sender's domain contains "microsoft" but does not end with "microsoft.com". This is a common tactic used in phishing attacks to spoof legitimate Microsoft domains, tricking recipients into believing the email is from a trusted source.
This rule identifies suspicious email attachments based on their file type (e.g., executables, scripts) or if they exceed a defined size threshold. It aims to detect potential data exfiltration or the delivery of malicious files via email.
This rule identifies and analyzes user interactions with URLs embedded in emails, specifically focusing on emails that are either inbound or intra-organizational. It determines which users clicked on URLs within these emails and provides a summary of this activity. This analysis is particularly useful in security contexts, where understanding user behavior regarding potentially risky links can help in identifying phishing attacks or other malicious activities.
This rule detects PowerShell activity on user workstations within 30 minutes of receiving an email from a known malicious sender. It aims to identify potential post-compromise activity initiated by a successful phishing attempt.
This rule detects Tycoon and ODx AiTM phishing activity that bypasses MFA. It matches:
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
This query hunts for files shared by a specified malicious sender on user devices. It identifies if attachments from emails sent by the malicious sender have been downloaded, saved, or are present on the user's devices by joining email attachment information with device file events based on the SHA256 hash of the attachment.
This rule detects outbound automatic reply emails sent from an organization's users to external recipients. It specifically looks for emails with subjects starting with "Automatic reply:" that have been delivered and are outbound.
Hunts for Office 365 emails that contain URLs of popular Monero exchanges or keywords related to Monero wallet addresses. This could indicate phishing attempts, scams, or other illicit activities.
Detects potential data exfiltration from cloud storage or SaaS platforms based on a large volume of data transferred or a high number of distinct files accessed by a single user or application within a one-hour window. This is a common TTP for threat actors like ShinyHunters who aim to steal large datasets.
Suspicious Email Impersonating DocuSign Service Sent to {{RecipientEmailAddress}}
Flags an inbound phishing email impersonating the DocuSign service using lookalike domains, URLs, or attachments.
Flags an inbound phishing email impersonating the DocuSign service using lookalike domains, URLs, or attachments.
This rule detects attempts to disable Multi-Factor Authentication (MFA) within Microsoft 365 services. Specifically, it looks for audit log entries containing the operation 'Disable Strong Authentication.' This action could be performed by an attacker to maintain persistent access to compromised accounts by removing an important security layer.
Possible compromise of Microsoft 365 account {{RecipientEmailAddress}} following a device code phishing campaign leveraging microsoft.com/devicelogin to obtain OAuth tokens from an attacker-controlled session.
Detects the addition of a new Federated Domain within Microsoft 365 audit logs. This activity can be a legitimate administrative action but also indicates potential federated credential abuse or the establishment of a backdoor via federated identities.
This rule detects the upload of files to cloud storage services that are known to be used for data exfiltration or are associated with suspicious tunneling activities. It leverages a list of suspicious domains (LOTTunnels) to identify potentially malicious file uploads.
This rule detects the creation of new Microsoft Power Automate flows that are configured to use connectors capable of exfiltrating data via email or collaboration platforms like Microsoft Teams. It specifically looks for flows created with connectors which could indicate an attempt to send sensitive information outside the organization.
The analytic detects when a Windows RDP client attempts to execute an RDP file from a temporary directory, downloads directory, or Outlook directories. This detection is significant as it can indicate an attempt for an adversary to deliver a .rdp file, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network.
This rule detects an impersonation event within Microsoft Teams, specifically when the 'TeamsImpersonationDetected' action type is logged. It extracts the User ID and the Sender's User Principal Name (UPN) associated with the detected impersonation.
This rule detects potential data exfiltration attempts via email by monitoring internal users sending emails to external domains. It flags suspicious activity based on three criteria: a high volume of emails sent (over 100) combined with a large total data size (over 50 MB), a significant number of emails sent to personal domains (over 20), or a notable count of emails with sensitive subjects (over 5). The rule aggregates these metrics over a 1-day window for each user.
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
This rule detects instances where an email with identified threats (e.g., malware, phishing) is received and a URL within that email is subsequently clicked by a user. It correlates email threat information with URL click events to identify successful user interaction with malicious links.
Page 144 of 179