Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,749 detections
Filters
Last updated
All Time
Detection languages
2,543
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,244
994
880
773
476
Platforms
2,849
1,449
1,229
356
73
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
1,096
988
949
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects an inbound email flood attack (many distinct senders to a single recipient within a 5-minute window) followed by an external Microsoft Teams message sent to the same user, typically associated with IT support pretexting or callback phishing attacks.
Correlates an interactive MFA-satisfied user sign-in with a subsequent non-interactive or token-based successful authentication from a different IP address and country within a short time window for the same user and application. This pattern is indicative of adversary-in-the-middle (AitM) phishing attacks where session cookies or tokens are intercepted and replayed.
Detects Microsoft Teams chat creation events originating from an external sender whose user ID or display name impersonates IT support (e.g., IT Support, Help Desk, Service Desk), often used in social engineering or phishing attempts.
Detects the creation or modification of inbox rules in Exchange Online that target financial-related keywords and hide/delete mail, or rules that mark all incoming mail as read and delete them, which may indicate a Business Email Compromise (BEC) attack or mailbox evasion technique.
Detects external Microsoft Teams messages containing support-related social engineering lures or originating from known malicious/IOC tenant domains, summarizing sender and thread metrics. The query ran without errors in a live tenant.
Detects Microsoft 365 token replay from the Huntress token spray and replay campaign. Alerts on sign-ins from an IP new to the account (not seen on 3 or more distinct days in the 14d baseline) that match one of three behaviors: a scripted client (node or bare Mozilla/5.0 user agent with Office or Authentication Broker client IDs), Device Registration Service access (Medium-High only when corroborated by a campaign IP, scripted user agent or session IP hop, otherwise Low), or one session moving across IPs within 60 minutes. Rows are raised to High when the same new IP hits 3 or more baseline accounts in the window (token spray pattern) or matches a campaign IOC. Low Signal rows are dropped when AlertOnly = true. Does not cover MFA changes, device registration events or inbox rules.
Detects correlation between an external Microsoft Teams chat creation and the subsequent launch of a remote access or monitoring (RMM) tool on the same user's device within a 30-minute window, which is indicative of potential social engineering or tech support scam initial access campaigns.
Detects when a user authenticates via device code flow or performs device registration/ownership addition, followed by a bulk download of SharePoint or OneDrive files (25 or more distinct files) within a 60-minute window. This behavior can indicate session hijacking or unauthorized access where an attacker uses device code phishing to gain access and quickly exfiltrate cloud documents.
Detects a mail bombing pattern where a recipient receives a burst of inbound emails from many distinct senders within a short time window, followed by a Microsoft Teams message or chat creation from the same user context shortly after.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects a potential multi-stage social engineering attack where a user first receives a high volume of emails (mail-bomb burst) within a short window, followed shortly by an external Microsoft Teams message from a suspicious throwaway tenant using an IT help desk display name.
Detects inbound emails where the sender claims to be from an internal or organization domain but has a null envelope sender address, lacks valid DKIM authentication, and does not match common legitimate automated messages (like DSNs or auto-replies), potentially indicating email spoofing or phishing attempts.
Detects the presence of known malicious or suspicious OAuth application IDs as well as specific third-party applications like SkyKick or ConnectWise within OAuth application metadata over a 30-day window.
Audit query that finds enabled OAuth apps in Microsoft Entra ID holding permissions an attacker would want: reading or sending mail, accessing files and sites, planting credentials on other apps, assigning roles, or changing Conditional Access. App-only permissions (the app signs in as itself, with no user and no MFA) are split from delegated ones. High-privilege delegated grants are flagged only for external apps with no verified publisher, the typical consent-phishing shape. Output is one row per app with a plain-language ReviewReason, publisher, origin, admin consent, activity (Inactive 90d+ is the easiest to disable) and “(in use)” markers on permissions the app actually exercises, so a review team can decide to keep, reduce or disable.
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Audit query that finds enabled OAuth apps in Microsoft Entra ID holding permissions an attacker would want: reading or sending mail, accessing files and sites, planting credentials on other apps, assigning roles, or changing Conditional Access. App-only permissions (the app signs in as itself, with no user and no MFA) are split from delegated ones. High-privilege delegated grants are flagged only for external apps with no verified publisher, the typical consent-phishing shape. Output is one row per app with a plain-language ReviewReason, publisher, origin, admin consent, activity (Inactive 90d+ is the easiest to disable) and “(in use)” markers on permissions the app actually exercises, so a review team can decide to keep, reduce or disable.
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Detects potential password spraying behavior in Entra ID sign-in logs, characterized by a single source IP attempting authentication against numerous distinct user accounts with a low number of attempts per user.
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Detects a potential social engineering or phishing attack pattern where a recipient first receives a high volume of inbound emails (mail flood) within a short window, followed quickly by an external Microsoft Teams chat message from an IT-themed sender attempting to impersonate internal support.
Detects high-volume Microsoft Graph API activity using attacker-associated user agents, such as python-requests, curl, or httpx, which may indicate automated token sweeping or data collection associated with supply-chain attacks.
Page 1 of 179