Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule monitors for high-frequency download or access events of files associated with AI development, such as model weights (.pt, .ckpt, .safetensors, .h5, .onnx, .pkl, .pb), checkpoints, and research datasets from cloud storage. It triggers when an account accesses or downloads 20 or more unique AI-related files within a 60-minute window, which is indicative of unauthorized data exfiltration of intellectual property.
Detects suspicious Microsoft Intune device enrollment activities characterized by the use of a spoofed User-Agent (matching Microsoft Office/Outlook strings) and rapid, multiple enrollment attempts within a short timeframe. This behavior is associated with adversary use of device-code phishing kits to enroll rogue devices using stolen session tokens.
Detects incoming emails from specific suspicious domains that pass authentication checks (SPF, DKIM, DMARC) but contain subject lines commonly associated with phishing campaigns, such as invoices, payment requests, or urgent notifications. The rule includes associated URL and attachment information for further analysis.
The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents.
This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access.
If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks.
This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access.
If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks.
Detects rapid access to multiple Microsoft 365 collection applications (Office, OneDrive, Teams) by a user account from specific AWS EC2 IP ranges identified as associated with the TeamFiltration tool. This behavior is consistent with automated exfiltration of email, chats, and files.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects rapid access to multiple Microsoft 365 collection applications (Office, OneDrive, Teams) by a user account from specific AWS EC2 IP ranges identified as associated with the TeamFiltration tool. This behavior is consistent with automated exfiltration of email, chats, and files.
Detects business email compromise (BEC) lures by identifying a discrepancy between the 'From' address and the 'Reply-To' address in conjunction with high-urgency keywords related to financial transactions. This logic is intended to catch AI-crafted phishing emails that bypass traditional signature-based filters but rely on structural artifacts like Reply-To misdirection.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects the creation or modification of Microsoft Power Automate flows that integrate internal Microsoft 365 services (SharePoint, OneDrive, Exchange) with external communication or exfiltration targets (HTTP requests, external email addresses, or common external web services). This behavior is often indicative of automated data exfiltration.
Detects the creation or modification of Microsoft Power Automate flows that integrate internal Microsoft 365 services (SharePoint, OneDrive, Exchange) with external communication or exfiltration targets (HTTP requests, external email addresses, or common external web services). This behavior is often indicative of automated data exfiltration.
Detects the creation or modification of Microsoft Power Automate flows that integrate internal Microsoft 365 services (SharePoint, OneDrive, Exchange) with external communication or exfiltration targets (HTTP requests, external email addresses, or common external web services). This behavior is often indicative of automated data exfiltration.
Detects the creation or modification of Microsoft Power Automate flows that integrate internal Microsoft 365 services (SharePoint, OneDrive, Exchange) with external communication or exfiltration targets (HTTP requests, external email addresses, or common external web services). This behavior is often indicative of automated data exfiltration.
This rule detects the presence of files matching known SHA256 hashes associated with the GhostCode phishing kit. It monitors for these files both in email attachments and on local device filesystems to identify potential delivery and execution of malicious phishing payloads.
Detects the creation or modification of Microsoft Power Automate flows that integrate internal Microsoft 365 services (SharePoint, OneDrive, Exchange) with external communication or exfiltration targets (HTTP requests, external email addresses, or common external web services). This behavior is often indicative of automated data exfiltration.
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Page 42 of 150