Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects anomalous, high-frequency, multi-channel probing of AI agent input surfaces. The rule identifies external actors sending instruction-injection style keywords across different communication channels (e.g., email, Teams, calendar) within a short window, which may indicate an attempt to identify and manipulate an organization's autonomous agents. Covers T1595.002
Detects a burst of MFA push/approval prompts (5+ in 10 minutes) to one user culminating in an eventual approval after repeated denials/timeouts — the push-bombing technique Scattered Spider and Mutant Spider pair with helpdesk vishing to exhaust remaining MFA resistance.
Correlates new OAuth application consent grants with a preceding helpdesk-driven password/MFA reset on the same user, catching attacker-installed OAuth persistence — echoes the 2026 Vercel/Context.ai OAuth-abuse incident that followed a similar trust-granting pattern.
Detects anomalous mass consent grants to OAuth applications by users within the environment. This rule monitors for high-risk permissions such as Mail.Read and Files.ReadWrite.All, which are commonly used in consent phishing and application-based persistence campaigns to gain unauthorized access to mailbox and file resources.
This rule detects potential MFA fatigue attacks (Push Bombing) by monitoring sign-in logs for a high volume of authentication prompts directed at a single user within a one-hour window. It specifically identifies patterns where a user receives multiple denied MFA push requests followed by at least one successful approval. The rule also accounts for suspicious behavior such as requests originating from multiple IP addresses or geographic locations.
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks by identifying an initial legitimate sign-in followed by a second sign-in from a different IP address within a short timeframe (indicative of session token replay), immediately succeeded by high-risk post-compromise actions such as OAuth application consent or the creation of malicious mailbox rules.
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
Detects emails containing a RAR attachment combined with a shortened URL. This combination is a common technique used in phishing campaigns to deliver malicious payloads while attempting to evade security filters.
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
This rule detects potential large-scale phishing campaigns by identifying email traffic patterns involving URLs hosted on the 'workers.dev' domain. It looks for a high volume of unique recipients and unique subject lines within a short timeframe, which is indicative of automated, mass-distributed phishing lures often used to evade traditional URL reputation filters.
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
Detects high-volume, potentially programmatic search activity in Microsoft 365 SharePoint, characterized by iterative pagination requests using the 'indexdocid' parameter. This behavior may indicate an automated effort to crawl or systematically exfiltrate document metadata or content via the SharePoint search interface, often associated with post-exploitation discovery or unauthorized data collection.
Detects anomalous, high-volume email access patterns (more than 200 mail items accessed per hour) by specific Client or Azure AD App IDs, which may indicate automated data collection or exfiltration by an adversary using compromised or unauthorized applications.
Detects anomalous, high-volume email access patterns (more than 200 mail items accessed per hour) by specific Client or Azure AD App IDs, which may indicate automated data collection or exfiltration by an adversary using compromised or unauthorized applications.
Detects high-volume, potentially programmatic search activity in Microsoft 365 SharePoint, characterized by iterative pagination requests using the 'indexdocid' parameter. This behavior may indicate an automated effort to crawl or systematically exfiltrate document metadata or content via the SharePoint search interface, often associated with post-exploitation discovery or unauthorized data collection.
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
Detects high-frequency, automated polling of Microsoft 365 mailbox data via the Microsoft Graph API, characteristic of malicious inbox scanning tools (e.g., Box Monitor). The rule correlates these persistent access patterns with subsequent searches for high-value financial keywords, identifying potential Business Email Compromise (BEC) reconnaissance.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects high-frequency, automated access to mail items via Microsoft Graph API (mail.read/MailItemsAccessed), consistent with automated scanning or exfiltration tools like ARToken's Inbox Monitor. The rule identifies suspicious patterns of repetitive access to mailbox folders or messages that may indicate Business Email Compromise (BEC) or automated credential-based harvesting.
Page 43 of 150