Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects anomalous outbound email activity from an account that recently performed an OAuth device code sign-in characterized by elevated risk levels. The rule identifies potential token abuse by looking for a high volume of emails with either a significant percentage of external recipients or patterns indicative of bulk mailing, common in phishing campaigns that leverage compromised identities (e.g., EvilTokens).
Detects high-volume deletion or recycling of files within OneDrive or SharePoint for a specific user, which may indicate malicious activity such as data destruction, ransomware, or unauthorized data exfiltration staging.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects inbound email messages containing keywords and phrases consistent with extortion attempts, specifically referencing stolen data, unauthorized access, and demands for cryptocurrency payment.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
Detects the TeamFiltration/UNK_CondorFiltration spray signature: a large
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
This rule detects instances where a user grants high-risk OAuth application permissions (e.g., Mail or Files access) within 30 minutes of a risky or MFA-challenged sign-in event. This pattern is indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker successfully steals a session and immediately establishes persistent access to the victim's resources via OAuth consent.
This rule detects a correlation between high-risk or anomaly-flagged sign-ins and subsequent changes to B2B guest invitation or tenant collaboration policies by the same user account within a 30-minute window. This behavior is indicative of an adversary who has successfully hijacked a session (e.g., via AiTM or token replay) and is attempting to establish persistence or pivot by inviting external accounts or modifying B2B security settings.
This rule detects mass-distributed email phishing campaigns that impersonate Google branding. It identifies emails using Google-related sender display names or subjects that originate from non-Google domains and contain links to external, non-Google domains. The detection focuses on identifying suspicious patterns across multiple recipients rather than individual email signatures.
Page 34 of 150