Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
Detects high-frequency, diverse Microsoft Graph API requests initiated by an identity, indicative of automated reconnaissance or enumeration of the cloud environment. The rule tracks requests across multiple categories such as organization settings, user/group identities, privilege information, application configurations, and resource access within a 30-minute window.
This rule monitors email, SMS, and voice logs for potential phishing attempts targeting user credentials. It specifically looks for social engineering lures related to passkey, SSO, or MFA updates that express urgency or imply service expiration, often masquerading as IT support communications.
Detects anomalous access patterns to Microsoft 365 SaaS applications where a single user session interacts with three or more specific portal applications (such as 'OfficeHome', 'My Apps', 'My Profile') within a five-minute window. This behavior may indicate an adversary attempting to map the environment or interact with multiple integrated services shortly after gaining access.
Detects Azure AD sign-in events where Multi-Factor Authentication (MFA) was reportedly satisfied by an External Authentication Method (EAM) claim without evidence of a traditional secondary authentication challenge. This behavior is indicative of a 'TrustSink' technique where a rogue or compromised OIDC provider injects a spoofed assertion of MFA success into the authentication token.
Detects high-frequency access to multiple sensitive Microsoft Graph API paths (users, groups, applications, directoryRoles, servicePrincipals, etc.) from a single identity within a short timeframe. This pattern is indicative of automated reconnaissance or enumeration of the cloud environment's identity and application landscape.
Detects a sequence of events indicative of an Adversary-in-the-Middle (AiTM) attack, specifically 'NovaCookies'. The rule identifies a phishing email lure (DocuSign/SharePoint-themed) received by a user, followed within a 6-hour window by an anomalous Microsoft 365 sign-in from that same user. The anomalous sign-in is defined by either risk flags or conditional access failure, suggesting potential replay of a captured session cookie.
Detects anomalous, high-frequency password submission patterns from a single IP address within a short timeframe, which is indicative of an Adversary-in-the-Middle (AiTM) phishing proxy (e.g., NovaCookies) testing multiple credentials before proceeding to MFA.
Detects a potential Adversary-in-the-Middle (AiTM) attack sequence by correlating OneDrive/SharePoint document sharing email lures with subsequent successful Microsoft 365 sign-ins from unusual locations or user agents within a short time window. This activity often indicates session cookie theft and MFA bypass.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
This rule detects potentially malicious messages sent via Microsoft Teams that contain keywords related to passkey enrollment or SSO updates, which are common social engineering tactics used in phishing campaigns to trick users into compromising their account credentials or security settings.
Detects high-volume, multi-endpoint enumeration activity against the Microsoft Graph API, involving a high frequency of requests across sensitive tenant resources (users, groups, applications, roles, mailboxes, etc.). This behavior is consistent with post-compromise reconnaissance by an adversary attempting to map the environment.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365 authentication flows. It identifies suspicious proxy traffic that contains authentication-related URIs or session-related cookies (such as ESTSAUTHPERSISTENT or refresh tokens) originating from hosts other than recognized Microsoft domains. This behavior is indicative of an attacker using a reverse proxy, such as Evilginx2, to intercept user credentials and session cookies in real-time.
Detects a sequence of events starting with a user signing in via the OAuth device code flow, followed immediately by mailbox item enumeration and sending of email. This pattern is characteristic of attackers who use device code phishing to steal tokens, subsequently using those tokens to access mailboxes and send malicious emails from the compromised account.
This rule detects phishing emails attempting to impersonate Apple or Find My services by monitoring for specific sender display names and subject lines. It specifically flags messages originating from personal email providers like Gmail and iCloud that do not belong to the legitimate apple.com domain, which is a tactic often associated with device-recovery lures used in phishing campaigns.
This rule detects anomalous backend activity associated with phishing kits, specifically monitoring for the dispatch of SMS or WhatsApp messages containing lure links. It identifies logs indicative of automated message dispatch (via send_sms_apix.log or WhatsApp Business API calls), filters for successful delivery indicators while excluding known error states, and verifies the presence of specific message components like recipient details and malicious templates.
Detects Workday self-service banking detail changes occurring shortly after suspicious mailbox reconnaissance activities, such as searching for payroll-related terms or accessing sensitive documents. This behavior is indicative of a payroll diversion fraud scheme following an Adversary-in-the-Middle (AiTM) session hijacking attack.
Page 46 of 150