Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule monitors authentication events for the 'deviceCode' protocol where multi-factor authentication (MFA) was not required or completed. This is a common indicator of device code phishing attacks, where an adversary lures a user into authorizing a malicious device or application, often bypassing organizational MFA policies.
Detects suspicious device registration or join events occurring within 60 minutes of a Device Code authentication flow. This pattern is consistent with the ARToken post-compromise technique, where an adversary uses an intercepted authentication code to register a new device to maintain persistent access to an Entra ID (Azure AD) environment.
Detects access to Microsoft Graph API endpoints related to mail, contacts, drive, or messages from a device that was registered within the last 24 hours. This behavior may indicate an adversary using stolen session tokens or credentials to access cloud-based email and data shortly after device registration or enrollment.
Detects non-interactive sign-in events to the Microsoft Graph API by applications that are not part of a known set of standard Microsoft applications. This pattern may indicate the use of stolen access tokens or compromised sessions (e.g., via device code phishing) to access M365 data without user interaction.
Detects anomalous, non-interactive Microsoft 365 sign-in events where an authentication session bypasses MFA via a previously issued token claim or device-code flow, indicative of ARToken or similar session hijacking and token replay attacks.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Detects email messages containing URL redirection chains through trusted services such as Google Meet, Google Custom Search Engine, DoubleClick, and Google Tag Manager. Attackers often abuse these legitimate services to mask the final destination of phishing links or to bypass email security gateways by using highly reputable domains.
Detects high-frequency, diverse access patterns against the Microsoft Graph API, indicative of automated enumeration or discovery of SharePoint, OneDrive, or search resources. The rule monitors for distinct paths (e.g., sites, drives, children) requested by a single actor within a 20-minute window.
This rule monitors Microsoft Teams communications for keywords related to passkey or Single Sign-On (SSO) configuration, which are common themes in social engineering and credential harvesting attacks. It correlates these messages with Windows logon events (Event ID 4624) for the sender to identify potentially compromised accounts or active phishing attempts originating from within the environment.
This rule identifies sustained, low-volume activity (low-and-slow) against Microsoft 365 services (SharePoint, OneDrive, and Exchange) which may indicate an adversary is using automated methods via the Graph API to collect sensitive files or emails over an extended period. The rule buckets events by user and time, requiring a minimum of three hours of activity with consistent but low-volume interactions to identify potential data collection behavior that avoids traditional volume-based detection thresholds.
Detects anomalous activity in Microsoft Graph API logs where a single user or application interacts with three or more distinct category endpoints (e.g., users, groups, mailfolders) and at least six unique paths within a 30-minute interval, suggesting reconnaissance or broad enumeration of the M365 tenant environment.
Detects high-volume, potentially automated data access, collection, or staging activities within Microsoft 365 services (SharePoint, OneDrive, and Exchange). The rule flags user identities performing a high count of operations (downloads, accesses, deletions, or export requests) across a wide range of unique objects or sites within a one-hour window, which is indicative of post-compromise mass data collection or exfiltration preparation.
Detects the addition of a new strong authentication method (MFA/authenticator device) to an account. This activity is a common indicator of persistence following a successful AiTM (Adversary-in-the-Middle) phishing attack or initial account compromise, as attackers establish their own MFA device to maintain long-term access.
Detects incoming or urgent security-themed emails (related to MFA, SSO, or passkeys) that originate from purported IT departments and are followed by a user clicking a link associated with Microsoft or authentication portals. This behavior is indicative of credential harvesting or consent phishing campaigns masquerading as internal IT security updates.
This rule detects successful authentication to Azure/M365 identity and security management portals (My Sign-Ins, My Apps, My Profile) shortly after a risky or suspicious sign-in event for the same user. This pattern often indicates an account takeover scenario where an adversary, having potentially compromised credentials, immediately accesses account settings to perform further malicious actions, such as registering MFA devices or updating security proofs.
Detects anomalous, high-frequency cloud management API requests across multiple sensitive paths (such as directory roles, applications, and service principals) from a single account. This pattern is indicative of automated enumeration or discovery of cloud infrastructure, permissions, and identity configurations, which is often a precursor to further exploitation.
Detects anomalous, high-volume file download activity from SharePoint or OneDrive initiated through identified anonymous proxy services. This behavior suggests potential data exfiltration by an adversary attempting to mask their source IP address while offloading large amounts of data.
This rule detects high-volume interactions with the Exchange Online REST API originated from the 'One Outlook Web' application ID, specifically filtering for events with associated token IDs. This pattern may indicate automated mailbox data exfiltration or unauthorized bulk email access, which has been observed in recent phishing-based identity compromise campaigns.
Detects high-volume, automated access and download activity targeting sensitive data within Microsoft 365 services (SharePoint, OneDrive, and Exchange) using the Microsoft Graph API. The rule identifies suspicious patterns of URI access associated with file downloading and mail item access, which may indicate automated data exfiltration by an adversary using compromised credentials or OAuth tokens.
This rule detects phishing emails attempting to impersonate executive roles (CEO, CFO, President) or using ServiceNow-themed lures (invoices, approvals) to solicit unauthorized ACH or wire transfers. The detection logic focuses on suspicious sender domains, payment-related keywords, and executive-specific titles in the email body.
Detects anomalous, high-volume file access and download activity targeting SharePoint or OneDrive. This behavior is identified by the use of the python-httpx User-Agent, which is often associated with automated scripts for data collection and exfiltration in cloud-based intrusions.
Page 44 of 150