Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,934
7,265
6,535
3,865
3,645
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Detects instances where an email previously detected as malware or phishing and quarantined is subsequently released and the recipient interacts with/clicks URLs contained within the email.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects historical network connections, URL clicks, browser launches, email URLs, and process command lines associated with Wazza phishkit infrastructure IOCs including boegl-krysl.eu, coppietersrecherche.eu, and beacon-surge-sync.workers.dev.
Detects successful OAuth device-code flow sign-ins where the user completed multi-factor authentication (MFA) from a non-compliant/unmanaged device using an IP address never seen in their 30-day baseline history. This behavior can indicate device-code phishing or token abuse.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Builds a 28-day hourly baseline of mail and file access operations (MailItemsAccessed, FileAccessed, FileDownloaded and SearchQueryPerformed) for each application identity and action type in CloudAppEvents, counting hours with no activity as zero, then alerts on each complete hour in the latest window where the identity’s operation count exceeds its average by more than three standard deviations and reaches a minimum volume.
Application identities legitimately read data at high volume, so a per-identity statistical baseline separates abuse of granted permissions from normal machine traffic where fixed thresholds fail. Identities with no activity in the baseline period are excluded, and a sustained change in behaviour, such as a large synchronisation or recovery job, will produce one result for each hour it remains elevated.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and tests the 25 complete hours ending two hours before each run, allowing for audit log ingestion delays while overlapping the previous run so that no hour is missed.
Where the display name matches the AccountId, Defender for Cloud Apps could not name the identity, which is common for Microsoft first-party services, so analysts should confirm the application before drawing conclusions.
Application identities legitimately read data at high volume, so a per-identity statistical baseline separates abuse of granted permissions from normal machine traffic where fixed thresholds fail. Identities with no activity in the baseline period are excluded, and a sustained change in behaviour, such as a large synchronisation or recovery job, will produce one result for each hour it remains elevated.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and tests the 25 complete hours ending two hours before each run, allowing for audit log ingestion delays while overlapping the previous run so that no hour is missed.
Where the display name matches the AccountId, Defender for Cloud Apps could not name the identity, which is common for Microsoft first-party services, so analysts should confirm the application before drawing conclusions.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects scenarios where a user's password is reset or sessions are revoked in Azure Active Directory, followed closely by mailbox access (items accessed, sent, or deleted) from a client IP address that was never seen interacting with that mailbox prior to the password reset event.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Page 3 of 150