Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,438
11,829
5,872
5,150
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects a suspicious sequence where Microsoft Outlook launches Microsoft Edge to open a URL, and that browser process subsequently makes network connections to infrastructure associated with the ClickFix phishing campaign (e.g., rsvpopenh.one or specific malicious IP).
This rule detects potential AI agent prompt injection by monitoring email subjects or attachment names for keywords often associated with system instruction overrides. It correlates these potentially malicious emails with subsequent execution of common administrative or script-interpreting binaries (e.g., PowerShell, cmd.exe) on the recipient's device within a one-hour window, suggesting a potential successful hijack of an automated process or AI agent.
This rule detects potential spear-phishing emails impersonating the Microsoft Account Team. The emails use lures related to one-time password (OTP) security notices and contain malicious ZIP or LNK files. It monitors sender addresses, display names, and subjects typical of this phishing campaign, and flags emails containing specific attachment patterns designed to trick users into executing malicious code.
Detects proxy requests directed towards the Microsoft OAuth2 device authorization endpoint originating from suspicious referrers (e.g., .de top-level domains). This pattern is consistent with device code phishing attacks where users are redirected from external malicious sites to a legitimate Microsoft authentication page to obtain an authorization code.
Detects incoming phishing emails that contain both a shortened URL and references to a password-protected RAR archive, often used to deliver malware while bypassing email security content inspection.
This rule detects potential social engineering attacks where an attacker initiates a Microsoft Teams call from an external domain while impersonating an internal IT support or help desk entity. The detection specifically correlates this event with a recent preceding email bombing campaign (exceeding 20 emails) targeting the same user within the last 3 hours, indicating a coordinated attempt to pressure or confuse the victim.
Detects incoming spearphishing emails that contain a ZIP archive attachment. The rule alerts if the archive contains an LNK file with a double extension (e.g., .pdf.lnk) or if the email subject contains specific social engineering lures related to food pricing or peace negotiations.
This rule detects a multi-stage phishing campaign where an attacker uses legitimate Notion infrastructure to host PDF invitation lures. The detection correlates email delivery of a Notion-themed invitation with a subsequent user click on a URL containing device code authorization keywords (such as 'device', 'devicelogin', or 'code') within a 60-minute window, which is indicative of a device-code harvesting attack.
This rule detects potential account hijacking via OAuth device-code authorization flow, specifically identifying patterns associated with phishing kits (e.g., EvilTokens, ARToken). It monitors sign-in events where the device code flow is utilized, specifically flagging successful grants that potentially bypass standard interactive credential prompts.
This rule detects inbound email messages containing HTML or related file types (htm, mhtml, shtml) that passed all standard authentication checks (SPF, DKIM, DMARC). This combination is often indicative of malicious phishing campaigns (such as those using LinXcoded or Mirage2FA techniques) sent from compromised, yet properly authenticated, Microsoft 365 or similar cloud-hosted email accounts, which bypass traditional sender reputation filters.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects web proxy requests that resemble phishing attempts targeting Apple Activation Lock. The rule identifies URLs containing specific Apple-related keywords in combination with common phishing URL paths, while filtering out legitimate Apple support documentation pages.
Detects incoming emails that use 'Apple' or 'Find My' related strings in the sender display name while originating from common consumer email relay domains like Gmail or iCloud, which is indicative of a social engineering or phishing attempt attempting to impersonate Apple support.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; the suspicious-URL signal requires a high-confidence credential/urgency term (not generic business vocabulary); sender risk requires the domain to be new to both the recipient and the organization; and at least three independent signal categories (not two) must corroborate the language-confusion signal before the rule fires.
Detects HTML smuggling files identified as 'FlipBook' lures, commonly used in device-code phishing campaigns. These lures utilize client-side JavaScript for AES-GCM decryption, extensive comment-based obfuscation, and specific junk-padding techniques to bypass security controls and trick users into providing credentials.
Detects network activity associated with the GhostCode phishing kit, including HTTP requests to specific access-prefixed subdomains and DNS lookups for those domains. Additionally, it detects HTTP responses containing specific spoofed browser tab titles often used in these phishing campaigns.
Detects HTML files utilizing the 'GhostCode' technique to hide malicious phishing redirects. The technique involves a password-protected HTML lure that uses JavaScript (Web Crypto API) to derive an AES-256-GCM key from a user-provided password via PBKDF2, decrypt an embedded ciphertext payload, and dynamically redirect the user to a concealed phishing URL.
Detects web traffic directed towards the AnonyMousKIT SMS relay API endpoint, commonly used by threat actors for dispatching SMS phishing lures. The rule monitors for requests to specific API paths related to SMS dispatching and analyzes the gateway status messages returned by the service.
Detects network requests (DNS queries or HTTP requests) to a predefined list of lookalike domains associated with the JWR phishing kit. These domains are designed to impersonate legitimate transport (LTA, OneMotoring, ERP) or courier/postal brands (Ninja Van, SingPost, Emirates Post) to deliver malicious payloads or credential harvesting pages.
Page 16 of 83