Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule detects when a user grants OAuth application permissions for high-risk scopes (e.g., Mail, Files) to an application that was registered within the last 7 days. It correlates this event with subsequent suspicious actions performed by the same user, specifically mailbox rule modifications or file download activity, which are common indicators of post-compromise activity following OAuth consent phishing.
Detects phishing emails containing suspicious URLs pointing to PaaS platforms (Azure Static Web Apps, Cloudflare, Firebase) that exhibit credential harvesting characteristics (branded keywords or base64 patterns). The rule correlates these emails with subsequent clicks and a successful M365 sign-in by the same user within 30 minutes of the click, indicating a probable successful credential compromise.
This rule detects mass phishing campaigns by identifying HTML/HTM email attachments that contain embedded URLs. It monitors for a pattern where the same sender distributes these attachments to multiple recipients, a common behavior for HTML smuggling delivery vectors where malicious payloads are constructed client-side to bypass static email gateway inspection.
Detects a sequence of suspicious activities associated with EvilTokens-style session hijacking. This includes the identification of non-interactive sign-in events involving the redemption of a refresh token without secondary MFA, followed by the creation or modification of Exchange Online mailbox rules to facilitate unauthorized email forwarding or exfiltration.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects high-volume, individually-tailored spear-phishing campaigns likely assisted by Generative AI. The rule monitors for a single sender targeting a high number of unique recipients with distinct, non-identical email subjects within a short timeframe. It specifically flags activity involving newly registered look-alike domains and interactions with credential-harvesting patterns in URLs.
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
This rule monitors for the creation or modification of inbox rules in Microsoft 365 that contain financial-related keywords (e.g., 'payment', 'wire', 'invoice') and disruptive actions such as deleting, moving, forwarding, or redirecting messages. These patterns are characteristic of Business Email Compromise (BEC) attacks, where adversaries attempt to conceal financial correspondence from the victim to facilitate fraudulent transactions.
This rule detects potentially malicious Microsoft Graph API activity, such as the enumeration of directory roles, groups, applications, or service principals. It identifies patterns indicative of token theft or unauthorized access by flagging scripted clients (non-browser agents) or accounts showing anomalous behavior (multiple IPs/agents) performing rapid or repetitive enumeration queries.
Detects instances where Microsoft 365 Copilot surfaces content labeled with sensitivity markings to a user who only has access to that content via inherited or broad sharing permissions (e.g., Company link, Anonymous link, or inherited permissions), rather than explicit access. This identifies potential AI-retrieval exploitation patterns where Copilot inadvertently exposes sensitive information due to oversharing configurations.
This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.
Detects the creation of email mailbox or transport rules that perform actions like hiding, deleting, marking as read, forwarding, or redirecting emails with finance or payment-related keywords. This behavior is indicative of a Business Email Compromise (BEC) post-exploitation workflow where adversaries attempt to conceal malicious activity or divert financial communications.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Page 40 of 150