Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
192
13
9
6
5
Contributors
70
39
34
22
15
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
191
50
12
11
10
Products / Services
196
33
25
24
7
MITRE Techniques
141
127
107
70
56
CVEs
2
IDS Classtypes
6
2
1
IDS Protocols
9
Detects inbound emails from external domains containing keywords related to financial transactions or urgency in the subject line (specifically matching forwarded or reply formats) accompanied by PDF or HTML attachments. This heuristic approach attempts to identify potential business email compromise (BEC) or phishing lures mimicking invoices or approval requests in environments where raw email body content is unavailable.
Detects inbound emails from external domains containing keywords related to financial transactions or urgency in the subject line (specifically matching forwarded or reply formats) accompanied by PDF or HTML attachments. This heuristic approach attempts to identify potential business email compromise (BEC) or phishing lures mimicking invoices or approval requests in environments where raw email body content is unavailable.
Detects inbound emails from external domains containing keywords related to financial transactions or urgency in the subject line (specifically matching forwarded or reply formats) accompanied by PDF or HTML attachments. This heuristic approach attempts to identify potential business email compromise (BEC) or phishing lures mimicking invoices or approval requests in environments where raw email body content is unavailable.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
This rule monitors for email events where the email is flagged for suspicious properties (SPF/DKIM/DMARC failure, threat categorization) and includes potentially malicious attachments or URLs. It then correlates these suspicious emails with subsequent process execution events on the recipient's endpoint within a 30-minute window, identifying a potential successful execution of a phishing payload.
This rule monitors for email events where the email is flagged for suspicious properties (SPF/DKIM/DMARC failure, threat categorization) and includes potentially malicious attachments or URLs. It then correlates these suspicious emails with subsequent process execution events on the recipient's endpoint within a 30-minute window, identifying a potential successful execution of a phishing payload.
Provides a consolidated view of email metadata, delivery outcomes, attachments, embedded URLs, sender infrastructure, and security verdicts for inbound and outbound email investigations.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
Detects inbound emails containing password-protected archives (rar, zip, 7z) from either common freemail providers or domains matching known social engineering themes (e.g., webinar, interview, research). The rule specifically flags emails where the subject or body includes password hints (e.g., 'pwd', 'extract', 'unzip') indicating an attempt to deliver malicious payloads while evading email gateway inspection.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
This rule monitors email traffic by aggregating data from email events, attachment information, and URL click interactions. It identifies emails that contain attachments and correlates them with specific file attributes (name, extension, hash, threat type) and any subsequent user interaction with URLs contained within those emails, including blocked or allowed clicks.
Detects spear-phishing emails associated with UNC1549, utilizing malicious career-themed lures. The rule identifies emails containing specific lookalike domain patterns related to Boeing, Airbus, or Teledyne FLIR, and correlates these with common recruitment-themed email subjects, HR-spoofing sender strings, or the presence of common compressed file attachments (ZIP, RAR, 7Z, ISO).
This rule monitors for potential spearphishing campaigns by tracking two behaviors: the delivery of emails containing known malicious URLs or lure-themed attachment names via email gateway logs, and the subsequent execution of files extracted from archives or matching lure patterns by EDR agents on endpoints.
This rule detects potentially malicious spearphishing emails containing suspicious file types (such as executables, scripts, or archives) that are sent with either a spoofed sender domain or a subject line containing common lures targeting IT/infrastructure teams. It focuses on identifying high-risk email deliveries that indicate social engineering and initial access attempts.
Detects SMTP traffic containing XLSX file attachments, specifically looking for base64 encoded content that matches the criteria for CVE-2025-60727. This rule monitors network traffic for the delivery of potential malicious Office documents.
Detects SMTP traffic containing XLSX file attachments, specifically looking for base64 encoded content that matches the criteria for CVE-2025-60727. This rule monitors network traffic for the delivery of potential malicious Office documents.
This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.
This rule monitors email gateway and EDR telemetry for indicators associated with the CastleLoader malware and the EvilTokens phishing campaign. It flags specific keywords in email subjects, filenames, sender domains, and URLs, as well as suspicious binary execution patterns and child processes spawning from common office applications or web browsers.
This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
Page 4 of 11