Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour).
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects a potential post-exploitation attack chain where a user receives a phishing lure and subsequently executes a rapid burst of distinct process commands on the same host. This pattern is consistent with an adversary utilizing an LLM to iteratively troubleshoot and refine command syntax during a post-exploitation phase.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
This rule detects potentially malicious emails that impersonate Microsoft account security notifications or security advisories. It looks for emails with specific social engineering themes in the sender name, sender address, or subject line, accompanied by .zip attachments that contain suspicious file names related to cybersecurity warnings or OTP abuse, which are common lures for malware delivery.
This rule monitors inbound emails for sender domains or embedded URLs that contain strings related to popular AI service brands (e.g., ChatGPT, Gemini, Claude). It flags these occurrences when the domain does not match the official, legitimate domains for those services, indicating potential phishing or brand impersonation attempts.
This rule monitors inbound emails for sender domains or embedded URLs that contain strings related to popular AI service brands (e.g., ChatGPT, Gemini, Claude). It flags these occurrences when the domain does not match the official, legitimate domains for those services, indicating potential phishing or brand impersonation attempts.
Detects the granting of tenant-wide admin consent for 'openid' and 'profile' scopes to 'AllPrincipals' within an Azure environment. This activity is indicative of the final stage in a TrustSink or similar rogue External Authentication Method (EAM) attack, where an adversary configures an application to bypass user consent prompts for sensitive identity scopes.
Detects successful sign-in events where Multi-Factor Authentication (MFA) was satisfied using an 'External Authentication Method' that reports specific claim identifiers ('possessionorinherence' or 'hwk'). This pattern is indicative of the TrustSink rogue-EAM (External Authentication Method) technique, where an attacker exploits custom MFA providers to forge MFA success assertions, effectively bypassing legitimate hardware-key requirements.
This rule detects potential phishing emails themed around financial documents or shared files that contain URLs associated with device-code authorization phishing lures, such as ARToken PhaaS, or links hosted on workers.dev platforms commonly used for such activities.
Detects potential theft and reuse of session or refresh tokens for Microsoft 365 services (Exchange/SharePoint) by identifying multiple authentication events for the same user account from different geographic locations and IP addresses within a short timeframe, specifically when no new MFA challenge was performed.
Detects potential abuse of the Microsoft Graph API by correlating device-code authentication events with subsequent high-volume activity, such as mail or file enumeration, from the same account within a short window. This pattern is indicative of ARToken-style token proxying, where an attacker intercepts an OAuth device-code token to gain unauthorized access to an user's resources.
Detects potential persistence establishment in M365 environments following anomalous or risky sign-in events. This pattern is characteristic of Adversary-in-the-Middle (AiTM) attacks where a session cookie is stolen, followed by immediate adversary actions to secure long-term access, such as MFA method registration, OAuth app consent, or mailbox rule configuration.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects Azure AD/Entra ID sign-ins performed using the OAuth device-code flow, excluding common administrative tools like the Azure CLI or PowerShell. This flow is frequently abused in phishing campaigns (such as EvilTokens or ARToken) where attackers entice victims to enter a device code into a malicious application, allowing the attacker to gain authorized access to the victim's session.
Detects potential account compromise by identifying a specific sequence of behavior: reconnaissance of sensitive users (HR/Payroll) via Microsoft Graph API calls, followed by the creation of inbox rules (e.g., forwarding) by the same user account within a 12-hour window.
Detects anomalous, automated non-interactive sign-in activity in Microsoft 365 where a session token is replayed from a new source IP address approximately every 8 hours. This pattern is characteristic of automated token-refresh tooling, such as that associated with Storm-2755, utilizing specific user-agents (Firefox 131.0/151.0 or python-requests) that deviate from the user's typical browser fingerprint.
Page 28 of 150