Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
192
13
9
6
5
Contributors
70
39
34
22
15
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
191
50
12
11
10
Products / Services
196
33
25
24
7
MITRE Techniques
141
127
107
70
56
CVEs
2
IDS Classtypes
6
2
1
IDS Protocols
9
Detects inbound emails containing attachments with file extensions commonly used for HTML/SVG smuggling (.html, .htm, .svg, .shtml, .xhtml). This technique is often used to bypass email security filters by assembling malicious payloads client-side after the email has been delivered. The rule specifically looks for inbound emails where the attachment has not been blocked or junked by the email gateway.
Detects suspicious execution of .scr (screensaver) files, execution of 'SecureMessage' named executables (potentially Pony malware), and email attachments containing .scr or .zip files, which are common vectors for malware delivery.
Detects emails containing embedded PNG, SVG, or JPG images (often QR codes) that are used in conjunction with a subject line indicating 'Code of Conduct' to bypass text-based URL filters and redirect users to an AiTM (Adversary-in-the-Middle) proxy. This technique is commonly used in phishing campaigns to steal authentication tokens.
Detects emails containing attachments that mimic voicemail files (e.g., .mp3.eml) with an HTML content type, often used in phishing campaigns. The rule specifically looks for dual extensions, HTML content type, a specific file size range, and subject line keywords related to financial institutions or unauthorized activity, indicating a potential Scotiabank impersonation or similar financial lure.
This rule detects highly suspicious email attachments that mimic voicemail notifications, specifically targeting Scotiabank users. It identifies emails with attachments named like 'v-mail_*.mp3.eml' or ending with '.mp3.eml' where the attachment's MIME type is 'application/html'. The rule also looks for specific subject line keywords related to Scotiabank, Interac, e-Transfer, unauthorized activity, or a specific monetary value ('3,000'), and checks for an approximate file size of 6000-9000 bytes, consistent with known phishing lures.
Detects an inbound policy-themed PDF attachment whose extracted URLs lead to a sign-in, authentication, review, or acknowledgement workflow outside the organisation. This rule specifically looks for PDF attachments in emails where the subject contains terms like 'code of conduct', 'policy', 'compliance', or 'handbook', and the extracted URLs within the PDF contain keywords such as 'login', 'signin', 'auth', 'review', or 'acknowledge'.
Detects an inbound policy-themed PDF attachment whose extracted URLs lead to a sign-in, authentication, review, or acknowledgement workflow outside the organisation. This rule specifically looks for PDF attachments in emails where the subject contains terms like 'code of conduct', 'policy', 'compliance', or 'handbook', and the extracted URLs within the PDF contain keywords such as 'login', 'signin', 'auth', 'review', or 'acknowledge'.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Detects delivery of macro-enabled Office documents via email clients
Detects the creation or modification of an inbox rule in Microsoft 365 where the rule's name consists entirely of special characters. This behavior can be indicative of an adversary attempting to evade detection by obscuring malicious inbox rules.
Identifies email attachments with a specific naming convention ('Agreement Settlement [Target] May [Day], 2026.pdf') used in a credential harvesting campaign. This rule looks for PDF files starting with 'Agreement Settlement' and ending with '.pdf', with a specific date format for May 2026.
This rule detects the presence of a Right-to-Left Override (RLO) character sequence in the content of an email sent over SMTP. The RLO character (U+202E, represented as E2 80 AE in UTF-8) is often used in phishing or malware campaigns to visually reverse the order of characters in a filename, making an executable file appear to be a benign file type (e.g., 'document.txt.exe' could appear as 'document.exe.txt'). The rule specifically looks for this byte sequence in traffic destined for port 25 (SMTP) and flags it as trojan activity.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
This rule detects email attachments that use a double extension, specifically looking for files that appear to be common document or image types (doc, pdf, jpg) but have a hidden executable extension (exe, bat, vbs). This technique is often used by attackers to trick users into opening malicious files.
This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
This rule detects when a file, initially received as an email attachment, is subsequently observed on multiple endpoints within a 7-day period. It correlates SHA256 hashes from email attachment logs with device file events to identify widespread propagation of potentially malicious attachments.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Page 5 of 11