Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
192
13
9
6
5
Contributors
70
39
34
22
15
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
191
50
12
11
10
Products / Services
196
33
25
24
7
MITRE Techniques
141
127
107
70
56
CVEs
2
IDS Classtypes
6
2
1
IDS Protocols
9
This rule detects executable attachments (e.g., .exe, .bat, .cmd, .scr, .pif, .com) being delivered via SMTP email. It specifically looks for these file extensions within the 'filename' attribute of email attachments.
This rule detects phishing emails sent over SMTP that contain macro-enabled documents (Word or Excel files) as attachments. It specifically looks for base64 encoded content, the 'filename=' attribute, and uses a PCRE to identify common macro-enabled file extensions like .doc, .docx, .xls, .xlsm, and .xlsb within the filename.
This rule detects phishing emails that deliver survey or form lures by identifying specific content patterns within SMTP traffic. It looks for emails with 'Content-Type: application/' and 'filename=' headers, specifically targeting attachments with file extensions like .doc, .docx, .pdf, or .xlsx, which are commonly used in social engineering attacks to deliver malicious documents or forms.
This rule detects internal SMTP traffic that contains both 'Content-Type: application/' and 'filename=' in the email body. This combination is often indicative of an attachment being sent, and in the context of 'Lateral Phishing' (T1534), it suggests an attempt to send malicious attachments internally. The rule is set to trigger an alert if 5 such events occur from the same source IP within 300 seconds, indicating a potential automated or high-volume internal phishing attempt.
This rule detects emails with subjects related to financial transactions (Invoice, Purchase Order, PO, Payment, Order) that contain attachments with suspicious file extensions (.js, .hta, .vbs). It specifically filters for emails originating from domains not whitelisted as trusted and aggregates the count and average size of such attachments.
This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.
This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.
This rule detects email attachments with VBScript extensions (.vbs, .vbe) delivered via SMTP. It specifically looks for the filename attribute in the email flow to the server, indicating a potential malicious script delivery.
This rule detects when a file, initially received as an email attachment, is subsequently observed on multiple endpoints within a 7-day period. It correlates SHA256 hashes from email attachment logs with device file events to identify widespread propagation of potentially malicious attachments.
This rule detects emails with subjects related to financial transactions (Invoice, Purchase Order, PO, Payment, Order) that contain attachments with suspicious file extensions (.js, .hta, .vbs). It specifically filters for emails originating from domains not whitelisted as trusted and aggregates the count and average size of such attachments.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder.
It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
This rule detects messages within Microsoft Teams that have been identified by Microsoft Defender for Office 365 as containing phishing attempts, malware, or spam. It specifically looks for messages with 'Phish', 'Malware', or 'Spam' verdicts in the ThreatTypes field, allowing for quick identification and triage of malicious content.
This rule detects emails containing a specific URL (https://openclaw.ai/install.ps1) which is known to host a PowerShell script. This indicates a potential attempt to deliver malicious code via email, likely as part of a phishing campaign to execute the script on the recipient's system.
This rule identifies accounts receiving the most email and highest threat exposure by analyzing inbound email events. It counts total emails, delivered emails, junked emails, blocked emails, and specifically highlights emails with detected threats (Phish, Malware, Spam) that were successfully delivered to the user's inbox. The output is sorted to prioritize accounts with the highest number of delivered threats.
Detects emails containing threat-actor lure links to trojanized ScreenConnect MSI files, specifically targeting 'cld.pt' downloads with 'COMPROBANTE*.msi' patterns. The rule also looks for 'COMPROBANTE' keywords in email subjects as a fallback.
This query will generate an alert for any emails that Defender AIR identifies as malicious but has taken no AIR actions.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
This rule detects inbound emails classified as phishing or malware by the email security system. It summarizes the total number of such messages, provides sample subjects, and counts how many were blocked, delivered to mailboxes, junked, or had other actions. The rule specifically focuses on emails that were delivered to a mailbox, indicating a potential bypass of initial security measures or a need for further investigation.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
Page 6 of 11