Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule detects potential Adversary-in-the-Middle (AiTM) activity by identifying a pattern where a successful multi-factor authentication sign-in event is quickly followed by another successful sign-in for the same user from a different IP address, device, or geographic location. This behavior is indicative of session cookie theft and replay, commonly associated with phishing toolkits like Evilginx or NovaCookies.
This rule detects a multi-stage phishing campaign where an attacker uses legitimate Notion infrastructure to host PDF invitation lures. The detection correlates email delivery of a Notion-themed invitation with a subsequent user click on a URL containing device code authorization keywords (such as 'device', 'devicelogin', or 'code') within a 60-minute window, which is indicative of a device-code harvesting attack.
Detects potential Adversary-in-the-Middle (AiTM) session token replay attacks where a user successfully authenticates with MFA and is followed shortly by a subsequent successful login for the same user from a different IP address or device without a fresh MFA challenge, suggesting the use of a stolen session cookie.
This rule detects potential account hijacking via OAuth device-code authorization flow, specifically identifying patterns associated with phishing kits (e.g., EvilTokens, ARToken). It monitors sign-in events where the device code flow is utilized, specifically flagging successful grants that potentially bypass standard interactive credential prompts.
This rule detects inbound email messages containing HTML or related file types (htm, mhtml, shtml) that passed all standard authentication checks (SPF, DKIM, DMARC). This combination is often indicative of malicious phishing campaigns (such as those using LinXcoded or Mirage2FA techniques) sent from compromised, yet properly authenticated, Microsoft 365 or similar cloud-hosted email accounts, which bypass traditional sender reputation filters.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects incoming emails that use 'Apple' or 'Find My' related strings in the sender display name while originating from common consumer email relay domains like Gmail or iCloud, which is indicative of a social engineering or phishing attempt attempting to impersonate Apple support.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; the suspicious-URL signal requires a high-confidence credential/urgency term (not generic business vocabulary); sender risk requires the domain to be new to both the recipient and the organization; and at least three independent signal categories (not two) must corroborate the language-confusion signal before the rule fires.
Detects a sequence of events where a user performs a device-code authentication followed rapidly by a device enrollment, and subsequently continues to access cloud services (Microsoft Graph, Exchange Online, Intune) shortly after their account password has been reset. This pattern is indicative of persistent access maintained via a registered device or OAuth token that survives credential remediation.
Detects high-risk administrative actions in Microsoft 365, such as new MFA method registration, OAuth app consent grants, or email forwarding rule creation, occurring in sessions that lack fresh authentication (often indicative of a session-cookie replay attack).
Detects Microsoft 365 sign-in events where MFA was successfully satisfied, but the sign-in is simultaneously flagged by risk detection engines as exhibiting anomalous token or session characteristics, indicative of Adversary-in-the-Middle (AiTM) session hijacking.
This rule detects DNS lookups, email URL clicks, and network connections involving lookalike domains that mimic Singaporean government or infrastructure services (e.g., LTA, OneMotoring, ERP, Gov.sg). It employs a regex-based pattern match for common brand-keywords combined with high-risk top-level domains, identifying potential phishing activity associated with the JWR framework that utilizes algorithmically varied, single-suffix rotated lookalike domains.
This rule detects potentially malicious mailbox access patterns in Microsoft 365. It identifies instances where the 'MailItemsAccessed' action is performed using the Outlook ClientAppId, but in conjunction with an uncommon APIId and a suspicious user agent ('Client=REST' combined with specific Firefox versions). This pattern is indicative of automated session hijacking or unauthorized access via third-party tools rather than legitimate browser-based Outlook access.
Detects anomalous sign-in attempts to the OfficeHome application that result in OAuth error 90014 (frequently associated with application access issues or invalid consent) combined with an implausible mismatch between the reported Windows 10 operating system and mobile-specific browser user agents (e.g., Mobile Safari, Chrome Mobile). This behavior may indicate an adversary attempting to mimic legitimate device traffic to bypass conditional access policies or facilitate OAuth-based token manipulation.
Detects session hijacking (AiTM) attempts where a failed or interrupted sign-in (ResultType 50199) is followed by a successful login using the same SessionId but with an Axios user-agent, indicating automated replay of a stolen session token rather than legitimate browser usage.
Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.
Detects anomalous Microsoft Graph API activity characterized by user enumeration or querying for sensitive organizational groups (e.g., payroll, finance, HR) often associated with post-AiTM account-takeover reconnaissance. This detection specifically identifies multiple requests for sensitive URIs or high-count enumeration requests originating from suspicious User-Agent strings like 'axios/1.18.1', commonly observed in threat actor activity such as Storm-2755.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Page 33 of 150