Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects high-privileged Entra ID accounts successfully reaching the verification stage of the Self-Service Password Reset (SSPR) process. While SSPR is automatically enabled for administrative accounts, this activity is anomalous and potentially indicates an attacker focusing on discovered privileged accounts after performing broader enumeration.
Detects anomalous, high-volume account enumeration against the Microsoft Self-Service Password Reset (SSPR) endpoint from a single source IP. The rule identifies a pattern of mixed response codes, specifically interleaving '50034' (Account does not exist) with successful or other outcomes, which indicates the use of automated tools to validate the existence of corporate accounts via response differentiation.
Detects successful authentication events using the OAuth 2.0 device code flow. While a legitimate authentication method for devices without web browsers, this protocol is frequently abused by attackers in 'device code phishing' attacks to harvest access tokens and gain unauthorized access to cloud and SaaS applications.
This rule detects potentially suspicious reconnaissance activity against the Microsoft Graph API. It monitors for high volumes of diverse requests originating from a single account within a 30-minute window, specifically targeting multiple distinct object types such as users, groups, sites, and applications. Such behavior is indicative of an adversary attempting to enumerate or map the target cloud environment.
Detects the creation or modification of email inbox rules that perform suspicious actions such as deleting, moving to folders, or forwarding emails, specifically when those rules target keywords associated with sensitive financial or business communications like invoices, payments, or wire transfers. This behavior is indicative of an attacker attempting to hide evidence of a compromise or intercept sensitive business communications.
Detects instances where a user performs sensitive privilege escalation or administrative modifications (e.g., adding roles, consent to applications) within two hours of authenticating via the Entra ID device-code flow. This correlation is often indicative of OAuth application device-code phishing or token abuse, where an attacker tricks a user into granting permissions to a malicious application.
This rule identifies potential phishing attempts by correlating email delivery events with known suspicious sender addresses and URLs containing typosquatting domains impersonating legitimate organizations.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects incoming emails containing specific file extensions (.r01, .js) or subject lines/attachments related to a known supply chain lure campaign, where authentication protocols (SPF/DMARC) have failed. This combination of indicators is indicative of LausivLoader malspam delivery.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
This rule monitors Microsoft Graph API audit events to detect potentially malicious reconnaissance or enumeration activity. It identifies actors who access a diverse range of resource categories (such as directory, tenant, privilege, application, repository, and mailbox) within a short 30-minute window, suggesting automated discovery or unauthorized data mapping rather than standard administrative tasks.
Detects modifications to Microsoft Entra ID (Azure AD) Conditional Access policies that weaken security controls, such as disabling policies, adding exclusions, or removing MFA and compliant device requirements. The rule also alerts on deletions of Conditional Access policies and modifications occurring outside of standard business hours.
Detects anomalous reconnaissance activity targeting sensitive Microsoft Graph control-plane endpoints, including directory roles, MFA settings, application registrations, service principals, and OAuth consent configurations. The rule identifies high-volume access across multiple distinct sensitive endpoints within a short time frame, which is indicative of an adversary enumerating infrastructure to identify opportunities for privilege escalation, persistence, or bypass of security controls.
This rule monitors for updates to a user's multi-factor authentication (MFA) configuration, specifically detecting when a new device is registered or activated. Attackers often register their own devices as MFA second factors to maintain persistent access to a compromised user account.
Detects instances where a user account registers the PhoneAppOTP MFA method and subsequently performs a successful authentication using that method within a defined window, followed by authentication attempts originating from non-browser, likely automated, UserAgents (e.g., node, python, axios). This pattern may indicate an adversary who has registered their own MFA device to gain persistent, automated access to the account.
This rule detects inbound phishing emails that leverage urgent security themes (e.g., passkey, SSO, or MFA updates) to lure users into clicking links. It correlates these emails with subsequent URL clicks and suspicious sign-in activity, such as MFA failures, which are indicative of an attempt to compromise credentials or bypass MFA.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects modifications to a user account's authentication methods, specifically when an increase in the number of configured multi-factor authentication (MFA) devices or methods occurs. This is often associated with an adversary enrolling their own device to bypass MFA or maintain persistent access.
Detects emails from specific suspicious domains or senders masquerading as executive roles (CEO, CFO) that contain attachments with 'invoice' in the filename and subject lines indicative of urgent financial transactions (e.g., payment, wire transfer). This pattern is commonly associated with Business Email Compromise (BEC) and malicious document delivery.
Detects instances where a user grants high-privilege permissions (Mail.Read, Files.ReadWrite.All, offline_access) to an OAuth application within 24 hours of a risky sign-in event. This pattern is commonly observed in AiTM (Adversary-in-the-Middle) or consent-phishing attacks designed to establish persistent access to cloud resources.
Page 41 of 150