Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
192
13
9
6
5
Contributors
70
39
34
22
15
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
191
50
12
11
10
Products / Services
196
33
25
24
7
MITRE Techniques
141
127
107
70
56
CVEs
2
IDS Classtypes
6
2
1
IDS Protocols
9
This rule detects the presence of files matching known SHA256 hashes associated with the GhostCode phishing kit. It monitors for these files both in email attachments and on local device filesystems to identify potential delivery and execution of malicious phishing payloads.
This rule detects potential spear-phishing emails impersonating the Microsoft Account Team. The emails use lures related to one-time password (OTP) security notices and contain malicious ZIP or LNK files. It monitors sender addresses, display names, and subjects typical of this phishing campaign, and flags emails containing specific attachment patterns designed to trick users into executing malicious code.
Detects incoming spearphishing emails that contain a ZIP archive attachment. The rule alerts if the archive contains an LNK file with a double extension (e.g., .pdf.lnk) or if the email subject contains specific social engineering lures related to food pricing or peace negotiations.
This rule detects incoming email messages containing .zip attachments with filenames that mimic financial documents (e.g., NFe, DANFE, invoice-related keywords) combined with numerical strings. This naming pattern is commonly associated with phishing campaigns attempting to deliver malicious archives.
This rule detects known JavaScript payloads associated with the JWR phishing framework by matching their SHA-256 file hashes. This is a signature-based detection for malicious script files commonly used in phishing attacks.
This rule monitors email traffic for attachments with suspicious file types (.htm, .xhtml, .svg, .zip) or specific filenames commonly used in phishing campaigns. It focuses on emails associated with Amazon SES infrastructure, often indicative of phishing attempts leveraging reputable infrastructure to deliver malicious content or stager files.
Detects incoming emails containing specific file extensions (.r01, .js) or subject lines/attachments related to a known supply chain lure campaign, where authentication protocols (SPF/DMARC) have failed. This combination of indicators is indicative of LausivLoader malspam delivery.
This rule detects the presence of files matching known SHA256 hashes associated with the GhostCode phishing kit. It monitors for these files both in email attachments and on local device filesystems to identify potential delivery and execution of malicious phishing payloads.
Detects emails containing a RAR attachment combined with a shortened URL. This combination is a common technique used in phishing campaigns to deliver malicious payloads while attempting to evade security filters.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
This rule detects the presence of files matching known SHA256 hashes associated with the GhostCode phishing kit. It monitors for these files both in email attachments and on local device filesystems to identify potential delivery and execution of malicious phishing payloads.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
Detects inbound emails from external domains containing keywords related to financial transactions or urgency in the subject line (specifically matching forwarded or reply formats) accompanied by PDF or HTML attachments. This heuristic approach attempts to identify potential business email compromise (BEC) or phishing lures mimicking invoices or approval requests in environments where raw email body content is unavailable.
This rule monitors for email events where the email is flagged for suspicious properties (SPF/DKIM/DMARC failure, threat categorization) and includes potentially malicious attachments or URLs. It then correlates these suspicious emails with subsequent process execution events on the recipient's endpoint within a 30-minute window, identifying a potential successful execution of a phishing payload.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
Detects inbound emails from external domains containing keywords related to financial transactions or urgency in the subject line (specifically matching forwarded or reply formats) accompanied by PDF or HTML attachments. This heuristic approach attempts to identify potential business email compromise (BEC) or phishing lures mimicking invoices or approval requests in environments where raw email body content is unavailable.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Page 3 of 11