Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Flags anomalous volume of Entra ID sign-ins using the device-code authorization grant, matching the Kali365 phishing-as-a-service technique (sold on Telegram, ~$250/month per FBI PSA) that captures Microsoft 365 OAuth tokens through the legitimate device-code flow.
Flags installation of RMM tools (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop) on an endpoint shortly after that user's account undergoes a password/MFA reset — matches the post-vishing tooling pattern CrowdStrike attributes to Mutant Spider (loaders including PrionFlaire and SocksLoader) and Scattered Spider.
Flags changes to a user's registered SMS/voice MFA phone number followed by a successful high-risk sign-in — the SIM-swap/SMS-interception bypass step documented across the 2024-2026 vishing threat-report taxonomy (CrowdStrike, Mandiant, Pindrop).
Detects instances where a non-administrative user grants an OAuth application consent to access high-privilege Microsoft Graph scopes, such as 'Mail.Read', 'Directory.ReadWrite.All', or 'offline_access'. This pattern is frequently used in consent phishing attacks to maintain persistent access to sensitive cloud resources.
Detects inbound Microsoft Teams calls or chats originating from an external or federated tenant where the caller's display name mimics internal IT support or helpdesk personnel, a technique used in social engineering and vishing campaigns.
Detects high-velocity, multi-application sign-in activity within a short timeframe (<= 15 minutes) originating from suspicious Python-based user agents (requests library). This pattern is often indicative of automated script-based reconnaissance or unauthorized access attempts against Microsoft 365 services.
Detects successful authentication attempts in Azure AD or Microsoft 365 logs originating from known proxy/VPN service providers or identified by suspicious Python-requests user agent strings. The rule specifically filters for events where MFA was not satisfied, indicating potentially bypassed or failed security controls from potentially malicious infrastructure.
Detects a sequence of events where a user is targeted by an email bombing attack, subsequently receives an external or anonymous Microsoft Teams call, and finally launches a known remote access tool (e.g., AnyDesk, TeamViewer) on the same host within a one-hour window. This pattern is consistent with social engineering campaigns designed to trick users into providing remote access to their systems.
Detects a high volume of 'MailItemsAccessed' operations within a short 15-minute window performed by a specific application ID. This behavior is often indicative of automated, bulk exfiltration of emails from a Microsoft 365 environment, potentially by a compromised application or an attacker using a malicious OAuth application.
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
This rule detects illicit OAuth consent grant events where an application is granted high-risk delegated permissions. This behavior is indicative of consent phishing or 'ConsentFix' tradecraft, where attackers trick users into granting permissions to a malicious application, thereby enabling unauthorized access to mail and file data.
This rule detects illicit OAuth consent grant events where an application is granted high-risk delegated permissions. This behavior is indicative of consent phishing or 'ConsentFix' tradecraft, where attackers trick users into granting permissions to a malicious application, thereby enabling unauthorized access to mail and file data.
Detects emails that appear to have been injected or sent using the 'swaks' SMTP testing tool rather than a standard Mail User Agent (MUA). The rule identifies this activity by looking for the 'swaks' signature in the 'X-Mailer' header or by matching a specific 'Message-Id' pattern typical of swaks.
Detects sign-in events in Entra ID where the OAuth 2.0 device authorization grant (device code) flow is utilized. This flow is a common vector for phishing attacks designed to steal tokens by tricking users into authenticating on a secondary device, potentially bypassing MFA.
Detects spearphishing attempts targeting accounts payable departments that impersonate executives using keywords related to invoices or payments. The rule identifies potential AI-generated text patterns (such as structural formatting artifacts, approval thread markers, or comment-like structures) often found in machine-generated fraud content, combined with executive-sender impersonation and external email domains.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
This rule detects scenarios where a user account modifies Conditional Access (CA) policies (specifically targeting user or group inclusion/exclusion settings) within one hour of that same user account modifying authentication method policies. This pattern is potentially indicative of an adversary weakening security controls by adjusting authentication requirements and subsequently tampering with CA policies to maintain persistence or bypass MFA.
Detects Azure sign-in events claiming successful hardware-key or FIDO2 authentication where the authentication issuer is not part of a known-good allow-list. This behavior is indicative of a rogue MFA provider, such as the TrustSink attack, which issues forged tokens claiming MFA requirements were satisfied.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
Detects emails containing URLs to known GitHub repositories used as lures for fake coding challenges or job interviews. These lures are often associated with DPRK-aligned threat actors (e.g., Jade Sleet, TraderTraitor) targeting technical roles.
Page 30 of 150