Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,749 detections
Filters
Last updated
All Time
Detection languages
2,543
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,244
994
880
773
476
Platforms
2,849
1,449
1,229
356
73
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
1,096
988
949
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This analytic detects when an excessive number of files are synced from Office 365 by the same user over a short period of time. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. The rule specifically looks for `filesyncdownload*` operations with a `UserAgent` containing `*SkyDriveSync*` and filters out cases where the `SiteUrl` matches the user's flat ID, which could be legitimate personal sync activity. A threshold of more than 50 unique source file names downloaded by a single user is used to trigger the alert. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
This analytic detects the use of `mavinject.exe` for DLL injection into running processes. It specifically looks for command-line parameters such as `/INJECTRUNNING` and `/HMODULE`. This activity indicates potential arbitrary code execution, a common tactic for malware deployment and persistence. If confirmed malicious, this could allow attackers to execute unauthorized code, escalate privileges, and maintain persistence within the environment, posing a severe security risk.
This analytic detects the execution of AdvancedRun.exe, a utility that allows users to run programs with different administrative privileges, user accounts, or environment settings. It identifies the process by its name or original file name and flags common command-line arguments often used for configuration or specific execution parameters. Monitoring this activity is crucial as AdvancedRun can be leveraged by attackers for remote code execution, privilege escalation, or maintaining persistence within an environment, similar to tools like PsExec. If used maliciously, it could enable the execution of arbitrary commands or configuration-based automation.
The following analytic identifies instances where Multi-Factor Authentication (MFA) is disabled for a user within the Office 365 environment. It leverages O365 audit logs, specifically focusing on events related to MFA settings. Disabling MFA removes a critical security layer, making accounts more vulnerable to unauthorized access. If confirmed malicious, this activity could indicate an attacker attempting to maintain persistence or an insider threat, significantly increasing the risk of unauthorized access. Immediate investigation is required to validate the reason for disabling MFA, potentially re-enable it, and assess any other suspicious activities related to the affected account.
This analytic detects when an excessive number of files are downloaded from Office 365 by the same user over a short period of time. Office 365 may bundle these files together as a ZIP file, however each file will have its own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
This analytic identifies potential privilege escalation activities within an organization's Active Directory (AD) environment by correlating multiple analytics from the "Active Directory Privilege Escalation" analytic story within a specified time frame. This is significant for a SOC as it helps identify coordinated attempts to gain elevated privileges, which could indicate a serious security threat. If confirmed malicious, this activity could allow attackers to gain unauthorized access to sensitive systems and data, leading to potential data breaches and further compromise of the network.
This analytic identifies failed authentication attempts against an Azure AD tenant during the Multi-Factor Authentication (MFA) challenge, specifically flagged by error code 500121. It leverages Azure AD SignInLogs to detect these events. This activity is significant as it may indicate an adversary attempting to authenticate using compromised credentials on an account with MFA enabled. If confirmed malicious, this could suggest an ongoing effort to bypass MFA protections, potentially leading to unauthorized access and further compromise of the affected account.
This analytic identifies when a new owner is assigned to an application registration within an Azure AD and Office 365 tenant. This activity is significant because assigning a new owner to an application registration can grant significant control over the application's configuration, permissions, and behavior. If confirmed malicious, an attacker could modify the application's settings, permissions, and behavior, leading to unauthorized data access, privilege escalation, or the introduction of malicious behavior within the application's operations.
The following analytic identifies the addition of a new federated domain in an Office 365 environment. This behavior is detected by analyzing Office 365 management activity logs, specifically filtering for Workload=Exchange and Operation="Add-FederatedDomain". The addition of a new federated domain is significant as it may indicate unauthorized changes or potential compromises. If confirmed malicious, attackers could establish a backdoor, bypass security measures, or exfiltrate data, leading to data breaches and unauthorized access to sensitive information. Immediate investigation is required to review the details of the added domain and any concurrent suspicious activities.
This analytic identifies instances where tenant-wide admin consent is granted to an application within an Azure AD and Office 365 tenant. It leverages O365 audit logs, specifically events related to the "Consent to application." operation within the AzureActiveDirectory workload, and filters for `ConsentType = "AllPrincipals"`. This activity is significant because admin consent allows applications to access data across the entire tenant, potentially exposing vast amounts of organizational data. If confirmed malicious, an attacker could gain extensive and persistent access to organizational data, leading to data exfiltration, espionage, further malicious activities, and potential compliance violations.
The following analytic detects the use of the .NET compiler csc.exe for on-the-fly compilation of potentially malicious .NET code. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns associated with csc.exe. This activity is significant because adversaries and malware often use this technique to evade detection by compiling malicious code at runtime. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
The following analytic detects potential scanning activities within a Kubernetes environment. It identifies unauthorized access attempts, probing of public APIs, or attempts to exploit known vulnerabilities by monitoring Kubernetes audit logs for repeated failed access attempts or unusual API requests. This activity is significant for a SOC as it may indicate an attacker's preliminary reconnaissance to gather information about the system. If confirmed malicious, this activity could lead to unauthorized access to sensitive systems or data, posing a severe security risk.
This analytic identifies when built-in Microsoft 365 security detections for suspicious email behaviors are triggered. These alerts often indicate that an attacker may have compromised a mailbox within the environment, leading to activities such as suspicious email sending patterns, user restrictions from sending email, suspicious email forwarding activity, or email sending limits being exceeded. Monitoring these alerts is crucial for responding to potential account compromises and malicious email activities.
This analytic identifies when a user with sufficient access to Exchange Online alters the mail flow/transport rule configuration of the organization. Transport rules are a set of rules that can be used by attackers to modify or delete emails based on specific conditions. This activity could indicate an attacker hiding or exfiltrating data by manipulating email flow.
The following analytic identifies instances where a single service principal creates more than three unique OAuth applications within a 10-minute timeframe. It leverages O365 logs from the Unified Audit Log, focusing on the 'Add service principal' operation in the Office 365 Azure Active Directory environment. This activity is significant as it may indicate a compromised or malicious service principal attempting to expand control or access within the network. If confirmed malicious, this could lead to unauthorized access and potential lateral movement within the environment, posing a significant security risk.
This rule detects the creation of new mail flow rules in Office 365 that are configured to redirect or copy emails to unauthorized or external addresses. It specifically looks for the "New-TransportRule" operation in Office 365 Management Activity logs, combined with parameters such as "BlindCopyTo", "CopyTo", or "RedirectMessageTo". Such activity can indicate potential data exfiltration, unauthorized access to sensitive information, or an attacker attempting to intercept email communications, which could lead to data breaches or information leakage.
The following analytic detects the use of Regsvr32.exe to register DLLs from suspicious paths such as AppData, ProgramData, or Windows Temp directories. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because Regsvr32.exe can be abused to proxy execution of malicious code, bypassing traditional security controls. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
This analytic detects email attachments with an unusually high number of spaces in their file names, which is a common tactic used by attackers to obfuscate file extensions. It leverages the Email data model to identify attachments where the ratio of spaces to the total file name length exceeds 10%. This behavior is significant as it may indicate an attempt to bypass security filters and deliver malicious payloads. If confirmed malicious, this activity could lead to the execution of harmful code or unauthorized access to sensitive information within the recipient's environment.
This analytic identifies when specific Office 365 advanced security settings related to anti-phishing, safe links, safe attachments, or malware protection are altered within the Office 365 tenant. An attacker disabling these settings could reduce their risk of detection, potentially leading to unauthorized data access, data exfiltration, account compromise, or other malicious activities without leaving a detailed audit trail.
The following analytic detects instances where the inbox folder of an Office 365 mailbox is shared with all users within the tenant. It leverages Office 365 management activity events to identify when the 'Inbox' folder permissions are modified to include 'Everyone' with read rights. This activity is significant as it represents a potential security risk, allowing unauthorized access to sensitive emails. If confirmed malicious, this could lead to data breaches, exfiltration of confidential information, and further compromise through spear-phishing or other malicious activities based on the accessed email content.
Page 170 of 179