Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,749 detections
Filters
Last updated
All Time
Detection languages
2,543
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,244
994
880
773
476
Platforms
2,849
1,449
1,229
356
73
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
1,096
988
949
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.
Detects when Microsoft Cloud App Security reports activities performed by users whose accounts have been terminated in Azure AD, but are still active in other platforms like AWS or Salesforce. This is particularly relevant for accounts used to manage resources that might not be terminated when a user leaves the company.
Detects when Microsoft Cloud App Security reports an unusual volume of file deletions by a user, which could indicate malicious activity such as data destruction or ransomware.
Detects the addition of a new Federated Domain in Microsoft Exchange. This event can be indicative of credential abuse or the establishment of a backdoor via federated identities, potentially in the context of a Golden SAML attack.
Detects when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that are potentially infected with ransomware. This indicates a possible ransomware attack attempting to encrypt or exfiltrate data via cloud storage.
Detects when Microsoft Cloud App Security reports that users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are associated with malicious activities, such as Botnet Command and Control, and may indicate a compromised account.
Detects when Microsoft Cloud App Security reports user activity originating from an IP address identified as an anonymous proxy. This indicates potential attempts to obscure the true source of network connections, which could be used for malicious purposes such as bypassing security controls or maintaining anonymity during an attack.
Detects when Microsoft Cloud App Security identifies a user or IP address using an unsanctioned application to perform activities resembling data exfiltration from the organization. This rule specifically triggers on 'Data exfiltration to unsanctioned apps' events with a 'success' status from the SecurityComplianceCenter event source.
Detects when Microsoft Cloud App Security reports an activity originating from a country that has not been recently or ever visited by any user within the organization. This indicates potential unauthorized access or anomalous user behavior from an unusual geographic location.
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365. This rule will apply to ExchangePowerShell usage and from the cloud.
Detects when the Microsoft 365 Security Compliance Center restricts a user from sending email because they exceeded service sending limits. This could indicate a compromised account being used for spamming or other malicious activities, or a legitimate user exceeding limits due to unusual activity.
Detects when Microsoft Cloud App Security reports suspicious email forwarding rules, such as a user creating an inbox rule to forward copies of all emails to an external address. This activity can indicate an attempt to exfiltrate sensitive information.
Detects the usage of the PowerShell `Set-Mailbox` cmdlet to configure an SMTP forwarding rule for a mailbox. This can be indicative of an adversary setting up automatic email forwarding to an external address for data exfiltration or continued access to communications.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
End User Consent
Sigma
Detects when an end user consents to an application
Detects when end user consent is blocked due to risk-based consent.
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions
Detects the addition of a new Federated Domain.
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.
Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.
Page 178 of 179