Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,749 detections
Filters
Last updated
All Time
Detection languages
2,543
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,244
994
880
773
476
Platforms
2,849
1,449
1,229
356
73
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
1,096
988
949
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects a suspected device-code phishing attack where a user visits a known malicious lure domain and shortly thereafter completes a successful Microsoft 365 device-code authentication. This rule correlates network events with sign-in logs within a 10-minute window to identify session hijacking attempts that bypass traditional MFA.
Detects a suspected device-code phishing attack where a user visits a known malicious lure domain and shortly thereafter completes a successful Microsoft 365 device-code authentication. This rule correlates network events with sign-in logs within a 10-minute window to identify session hijacking attempts that bypass traditional MFA.
Detects modifications to domain federation settings in Microsoft Entra ID (formerly Azure AD) where a domain is converted from a managed authentication state to a federated authentication state. This type of configuration change is often used by adversaries to establish persistence or facilitate domain-level identity deception.
Detects an anomalous volume of file downloads from SharePoint or OneDrive by a user on an unmanaged, non-compliant device, shortly following a suspicious or risky sign-in event. The rule establishes a baseline for individual user behavior over 30 days and alerts when the current hourly download activity significantly exceeds that baseline.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects anomalous authentication patterns where a single source IP targets a high number of unique user accounts with failed authentication attempts over a rolling window. By filtering out SSO/Federated methods and specific service account patterns, this rule isolates low-and-slow brute-force or password-spraying activities designed to evade standard account lockout mechanisms.
Detects phishing messages that deliberately mix writing systems/scripts or use homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. This is the only translation that implements true sender-novelty checking via baseline lookups (a sending domain must be new to both the specific recipient and the organization as a whole to add risk). A weighted score (script-mixing=2, homoglyph=3, phishing vocabulary=2, sender-novelty=1, threshold=6) requires multiple corroborating signals before firing. Note: unlike the SPL/S1QL/CQL/CortexQL translations, this version does not strip brand/product tokens before the script check.
Detects a sequence of activity where a user receives a high volume of inbound emails (potential vishing or social engineering lures) within a short window, followed by the user executing Windows Remote Assistance or Quick Assist tools within the next 6 hours, which is highly indicative of remote access social engineering pre-cursors.
Detects emails that appear to have been injected or sent using the 'swaks' SMTP testing tool rather than a standard Mail User Agent (MUA). The rule identifies this activity by looking for the 'swaks' signature in the 'X-Mailer' header or by matching a specific 'Message-Id' pattern typical of swaks.
This rule detects a suspicious sequence of events where a user performs an unusual device-code authentication (potentially indicative of device code phishing) followed shortly by an OAuth application consent or permission grant event. It flags potential compromise if the sign-in is new for the user or occurs in a short timeframe, with optional indicators associated with the 'maillive.sbs' phishing infrastructure.
Detects anomalous device-authorization-grant (RFC 8628) activity indicative of device-code phishing attacks (e.g., Tycoon2FA). The rule identifies user accounts exhibiting a rapid succession of 'authorization_pending' (70016) status polling attempts followed by a successful token issuance (0), constrained to a short time window and excluding known first-party Microsoft CLI/dev-tool applications.
Detects emails from free-mail domains (@mail.com or @outlook.com) that contain a specific malicious infrastructure indicator in the InternetMessageId or originate from a known suspicious IP address associated with TA419-style spoofing campaigns. This indicates the email was relayed through unauthorized infrastructure rather than the expected legitimate mail providers.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication policies, specifically the registration, enablement, or modification of External Authentication Methods (EAMs). This activity can indicate an attempt to add a rogue authentication provider for persistent unauthorized access, bypassing standard MFA or conditional access policies.
This rule detects anomalous activity associated with the Antino backdoor, which uses Microsoft OneDrive as a dead-drop command-and-control (C2) channel. It identifies specific file paths related to heartbeat check-ins, operator tool drops, and exfiltration retrieval, summarizing events by user and IP to highlight potential malicious persistent communication and data transfer patterns.
Detects registration of a new actor-controlled MFA authentication method (phone, authenticator app, or software OTP token) via an Update user operation, matching the NO_DEVICE/NO_DEVICE_TOKEN/SoftwareTokenActivated pattern used to convert temporary compromise into durable identity persistence
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
This rule detects potential adversary-in-the-middle (AiTM) session hijacking by monitoring non-interactive sign-in events. It identifies when a refresh token is redeemed from a device identifier that does not exist in the user's recent interactive sign-in history and from a geographical location different from the user's last known interactive session.
Detects potential session cookie replay attacks by identifying sign-in events using SSO or session tokens from different IP addresses, geographic locations, or devices compared to an established user baseline, without a corresponding fresh MFA challenge in the same timeframe. This behavior is indicative of unauthorized access to an already-authenticated session.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects unauthorized POST requests to SharePoint WebPart gallery pages that lack valid authentication cookies, which may indicate exploitation of CVE-2026-65660. The rule monitors for POST methods to specific SharePoint pages while excluding requests that already contain standard SharePoint authentication cookies (FedAuth, rtFa).
Detects a successful self-service password reset followed shortly by an authentication method change on the same account -- the exact SSPR-then-MFA-reregistration sequence used by Storm-3068 and Storm-2949 for persistence.
Hardened before submission: switched TargetResources[0] positional indexing to mv-expand + type == "User" matching, consistent with the fix already applied to the Agent User group-membership rule.
MITRE ATT&CK: T1098.005 (Account Manipulation: Device Registration), T1556 (Modify Authentication Process)
Hardened before submission: switched TargetResources[0] positional indexing to mv-expand + type == "User" matching, consistent with the fix already applied to the Agent User group-membership rule.
MITRE ATT&CK: T1098.005 (Account Manipulation: Device Registration), T1556 (Modify Authentication Process)
Page 6 of 179