Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects high-volume API requests to Exchange REST services using a specific application ID or Outlook Web branding, where the account object ID is missing. This pattern is indicative of potential OAuth token abuse, where an attacker utilizes a stolen token to perform automated actions without the presence of a legitimate user session.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication methods policy where a new external authentication method is configured using a non-approved discovery URL. This could indicate an adversary attempting to configure a malicious identity provider to facilitate authentication bypass or unauthorized access.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication methods policy where a new external authentication method is configured using a non-approved discovery URL. This could indicate an adversary attempting to configure a malicious identity provider to facilitate authentication bypass or unauthorized access.
Detects high-volume file and data access events within Microsoft 365 services (SharePoint, OneDrive, Exchange) originating from Python-based user agents (e.g., 'python-requests', 'python-httpx'). This pattern is indicative of automated scraping, data exfiltration, or bulk activity performed by unauthorized scripts.
Detects high-volume file access or download activity by a single user in SharePoint or OneDrive over a 15-minute window. This behavior is indicative of bulk cloud data exfiltration often associated with extortion campaigns.
Detects high-volume, automated enumeration of cloud resources (SharePoint, OneDrive, or Exchange) via Graph API or search queries immediately following a user sign-in event. This behavior is indicative of session hijacking (token replay) followed by unauthorized scripted discovery, as opposed to legitimate user browsing activity.
This rule detects potentially malicious messages within Microsoft Teams that use common social engineering keywords related to security configuration changes (e.g., passkey, MFA, SSO). The detection specifically filters for users who have successfully logged in within the last 30 days to identify potential compromised accounts acting as internal senders.
This rule detects unauthorized mailbox access by identifying specific ClientAppId and API ID pairs known to be associated with an Office 365 email exfiltration toolkit. This activity is indicative of an attacker attempting to programmatically access or exfiltrate sensitive email data from the organization's environment.
This rule detects potentially unauthorized access or downloading of files from SharePoint and OneDrive, as well as specific MailItemsAccessed events associated with known exfiltration toolkit patterns within Microsoft 365. It flags individual events matching these criteria as a baseline for identifying suspicious data access behaviors.
This rule monitors successful user sign-ins using the 'deviceCode' authentication protocol that originate from an IP address previously unseen for that specific user within the last 24 hours. The Device Code flow is commonly targeted in phishing campaigns to bypass traditional credential-based MFA, making anomalous logins using this protocol a high-signal indicator of account compromise.
Detects anomalous, high-volume access to email items by specific applications known to be associated with suspicious activity or unusual access patterns within the Exchange environment, potentially indicating email harvesting or data exfiltration.
Detects sign-ins to Office Home or Office365 applications from unmanaged or unknown devices, followed by an unusual amount or variety of activity within SharePoint Online or OneDrive for Business within a two-hour window. This behavior is indicative of potential unauthorized access or account compromise where an actor is using a non-corporate device to interact with sensitive cloud documents.
Detects high-frequency search queries in SharePoint that utilize internal document identifiers (indexdocid), which may indicate an adversary attempting to enumerate or scrape content across a site collection.
This rule detects a multi-stage attack chain targeting a single user within a 2-hour window. It identifies the combination of email bombing (a distraction technique), an incoming external or anonymous Teams call (social engineering channel), and the installation of common remote access tools (e.g., AnyDesk, TeamViewer) on the same host.
Detects anomalous authentication patterns in Microsoft 365 logs where a valid session is utilized across multiple distinct devices within a short timeframe (under 5 minutes) without a corresponding multi-factor authentication (MFA) challenge. This behavior is indicative of a session token replay attack, where an adversary uses a stolen session cookie to bypass MFA and access cloud services.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
This rule detects a multi-stage phishing attack, often referred to as 'quishing'. It identifies incoming emails containing image (JPG, PNG) or PDF attachments that embed previously unseen URLs, correlated with a subsequent sign-in event from a mobile device by the same recipient, which is a common indicator of Adversary-in-the-Middle (AiTM) credential harvesting.
Detects the creation or modification of inbox rules (e.g., forwarding, redirecting, deleting, or moving to hidden folders) that target finance, invoice, or payment-related communications, occurring shortly after an initial user sign-in from a new or unseen country/ASN within the last 30 days. This pattern is indicative of a post-compromise activity where an adversary attempts to exfiltrate financial data or hide malicious email activity.
Page 39 of 150