Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects instances where a user clicks on a URL within an email, and subsequently, the email is moved to quarantine. This sequence of events suggests that the email was initially delivered, a user interacted with a potentially malicious link, and then a post-delivery security action (quarantine) was taken, indicating a delayed detection of a threat, likely phishing or malware.
This rule detects email events that have an identified threat name and are associated with a URL click event. This combination suggests a user has clicked on a malicious link delivered via email.
This rule detects network connections, email activity, URL clicks, and Teams messages that involve domains commonly used by threat actor group Scattered Spider. It specifically looks for domains containing '-servicedesk.', '-okta.', '-sso.', '-cms.', '-helpdesk.', or 'oktalogin-'. The rule aims to identify potential phishing attempts or suspicious activity targeting SSO/helpdesk credentials by monitoring interactions with these specific domain patterns across multiple data sources.
This detection identifies emails containing links that use well-known URL shortening services (e.g., bit.ly, t.co, tinyurl.com). While these services are commonly used for legitimate purposes, they are frequently abused by threat actors to obfuscate malicious destinations. This detection joins EmailUrlInfo with EmailEvents to include sender metadata and filters out trusted senders based on a configurable watchlist (ShortenerSafeSenders).
The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. It leverages PowerShell Script Block Logging (EventCode 4104) to identify these commands. This activity is significant because these modules can be exploited by adversaries who have gained access via ProxyShell or ProxyNotShell vulnerabilities. If confirmed malicious, attackers could export mailbox contents, assign management roles, conduct mailbox searches, or view recipient objects, potentially leading to data exfiltration, privilege escalation, or unauthorized access to sensitive information.
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
This detection identifies when a one-on-one Microsoft Teams chat is initiated with an external domain that has not been observed in previous Teams chats (past 90 days) or recent email communications (past 15 days). This may indicate a new, potentially unsolicited or suspicious contact attempting to engage with an internal user, which could represent a social engineering attempt or early-stage reconnaissance.
This rule detects when a user is added to an administrative or management role in Azure Active Directory outside of defined business hours. It specifically looks for 'Add member to role completed' or 'Add app role assignment grant to user' operations where the target role contains 'admin' or 'Manage', and the event occurs outside of the configured business hours (7 AM to 6 PM local time, Monday to Friday).
This analytic detects the creation or modification of mailbox rules in Office 365, a technique commonly used in Business Email Compromise (BEC) attacks to hide malicious emails. It uses a scoring mechanism based on attributes like rule name entropy, name length, 'MarkAsRead' action, and 'MoveToFolder' destination to identify suspicious rules. A high score indicates a potential attacker has gained access to the account and is attempting to conceal their activities or exfiltrate information.
Detects emails delivered to user inboxes that contain both a PDF attachment and a URL identified as a phishing link. This rule is designed to identify modern QR code phishing (quishing) campaigns where the malicious URL is embedded within the PDF to bypass traditional email security scanning. The detection relies on the email security solution's ability to extract and flag URLs from attachments, including those embedded in QR codes.
This rule detects inbound emails containing URLs that are commonly used for OAuth consent phishing, where an attacker attempts to trick users into granting permissions to a malicious application.
This detection identifies when a Microsoft Teams message containing a URL associated with a known Remote Monitoring and Management (RMM) tool was sent and subsequently clicked by the intended recipient or the original sender. The domain is not part of the organization's approved RMM solutions, indicating a potential use of Living-off-the-Land RMM (LOLRMM) techniques often employed in initial access or persistence stages by threat actors.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
This detection identifies when Microsoft Teams applications send messages to groups / users in your organization's tenant. It utilizes the 'BotAddedToTeam' and 'AppInstalled' action types from CloudAppEvents to collect all Teams applications created in the specified timeframe and then joins on MessageEvents, matching events where SenderObjectId equals AppGuid.
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This rule detects when an application consent operation occurs in Azure Active Directory, specifically looking for broad consent types such as 'AllPrincipals' or when an administrator has granted consent. This can indicate a malicious application gaining wide permissions within the Azure AD tenant.
DefenderXDR Custom Detection
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
This rule detects potential spearphishing attempts where the sender's email address is from Gmail, there are no attachments or URLs, and the subject line of the email matches the recipient's first name. This pattern is often used in highly targeted social engineering attacks to appear legitimate and bypass traditional email security controls.
This rule detects the presence of specific file hashes (MD5, SHA1, SHA256) across device file events, device process events, and email attachment information. It is designed to identify known malicious files or indicators of compromise (IOCs) within an environment.
This search will find all inbound emails with attachments with filenames ending .lnk, indicative of a Windows Shortcut file.
This has been observed in the Serpentin#Cloud campaign
This has been observed in the Serpentin#Cloud campaign
This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6).
This rule detects emails containing a URL to a suspicious domain. It also checks if any of these suspicious URLs were subsequently clicked by a user, indicating potential compromise or successful phishing.
Page 145 of 179