Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.
Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.
This rule detects high-volume usage (500+ events per hour) of Microsoft Exchange Online resources by accounts that lack an associated AccountObjectId but utilize a TokenObjectId. This pattern is indicative of service accounts or potentially compromised tokens performing bulk actions, such as mass email access or data collection within the Exchange environment.
This rule detects anomalous behavior where an identity performs multi-category discovery (e.g., users, groups, directory roles, applications) via Microsoft Graph API within a single session, followed by intensive collection of content (files, attachments, or messages). This sequence is indicative of an adversary performing reconnaissance to map an environment before moving to data exfiltration or theft.
This rule detects the presence of files matching known SHA256 hashes associated with the GhostCode phishing kit. It monitors for these files both in email attachments and on local device filesystems to identify potential delivery and execution of malicious phishing payloads.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
This rule detects phishing emails where the sender's display name impersonates well-known brands (e.g., Microsoft, DocuSign, Zoom) while using a non-official domain. It further correlates these suspicious senders with embedded URLs that either match the targeted brands' domains or contain patterns commonly associated with device code phishing or API verification workflows.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects instances where a user account experiences multiple failed sign-in attempts followed by a successful sign-in from a different, geographically distant location within a short timeframe, indicating impossible travel and potential credential compromise.
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
Detects the creation or modification of inbox and transport rules in Office 365 that perform automatic email actions such as redirecting, forwarding, deleting, or marking emails as read, especially when targeting keywords related to sensitive information (e.g., invoice, payment, vendor, bank). This behavior is often associated with email account compromise and data exfiltration or persistence strategies.
Detects the creation or modification of email inbox rules that perform actions such as forwarding, deleting, or moving messages combined with keywords often associated with financial fraud, business email compromise (BEC), or credential harvesting. Adversaries often use these rules to hide communications, redirect financial emails, or automate data exfiltration.
Detects network connection events involving a specific known malicious IP address (5.230.71.51) identified as participating in unauthorized Intune enrollment or Entra ID device registration processes.
Detects network connection events involving a specific known malicious IP address (5.230.71.51) identified as participating in unauthorized Intune enrollment or Entra ID device registration processes.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
Detects phishing emails associated with the 'GhostCode' campaign, which uses an NDA or Supplier NDA Agreement pretext combined with WeTransfer links. The rule identifies suspicious emails by correlating the lure content with additional indicators such as specific lookalike sender domains, VoIP contact numbers, hardcoded ZIP passwords, or HTML attachments.
Page 49 of 150