Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,437
11,828
5,871
5,150
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects web traffic directed towards Google Apps Script endpoints that exhibit characteristics of malicious activity, specifically targeting browser-side data collection and user interaction lures. The rule identifies potential phishing attempts by correlating access to Google Apps Script pages (e.g., sidebars or add-ons) with external document-based referrers (e.g., Google Docs) or social media referrers, combined with scripts that attempt to exfiltrate user device environment data, location, or cryptocurrency wallet information.
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks by identifying an initial legitimate sign-in followed by a second sign-in from a different IP address within a short timeframe (indicative of session token replay), immediately succeeded by high-risk post-compromise actions such as OAuth application consent or the creation of malicious mailbox rules.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
Detects a suspicious sequence of network events consistent with a credential-harvesting campaign abusing the FedCM (Federated Credential Management) API. The rule identifies the initial fetch of a malicious loader script from a lookalike domain (pdf.gusercontent.com), followed closely (within 5 minutes) by a redirect to Google's legitimate 'EmbeddedSetup' sign-in flow containing an email parameter.
Detects a suspicious sequence of network events consistent with a credential-harvesting campaign abusing the FedCM (Federated Credential Management) API. The rule identifies the initial fetch of a malicious loader script from a lookalike domain (pdf.gusercontent.com), followed closely (within 5 minutes) by a redirect to Google's legitimate 'EmbeddedSetup' sign-in flow containing an email parameter.
Detects emails containing a RAR attachment combined with a shortened URL. This combination is a common technique used in phishing campaigns to deliver malicious payloads while attempting to evade security filters.
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
This rule detects interaction with specific infrastructure identified as deceptive dating applications. It monitors network communication, sign-in attempts, email interactions, and endpoint execution associated with known malicious domains (e.g., archat.us, heyhru.com, sitin.ai), specific IP addresses (38.129.138.244), and unique package identifiers (com.cavalier.nalo, com.qiga.vio). The detection logic spans across DeviceNetworkEvents, EntraIdSignInEvents, EmailUrlInfo, EmailEvents, DeviceEvents, and DeviceProcessEvents to identify exposure to these Indicators of Compromise (IOCs) across both network and endpoint layers.
This rule detects potential large-scale phishing campaigns by identifying email traffic patterns involving URLs hosted on the 'workers.dev' domain. It looks for a high volume of unique recipients and unique subject lines within a short timeframe, which is indicative of automated, mass-distributed phishing lures often used to evade traditional URL reputation filters.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Detects email messages containing URL redirection chains through trusted services such as Google Meet, Google Custom Search Engine, DoubleClick, and Google Tag Manager. Attackers often abuse these legitimate services to mask the final destination of phishing links or to bypass email security gateways by using highly reputable domains.
This rule monitors Microsoft Teams communications for keywords related to passkey or Single Sign-On (SSO) configuration, which are common themes in social engineering and credential harvesting attacks. It correlates these messages with Windows logon events (Event ID 4624) for the sender to identify potentially compromised accounts or active phishing attempts originating from within the environment.
Detects incoming or urgent security-themed emails (related to MFA, SSO, or passkeys) that originate from purported IT departments and are followed by a user clicking a link associated with Microsoft or authentication portals. This behavior is indicative of credential harvesting or consent phishing campaigns masquerading as internal IT security updates.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains associated with credential harvesting campaigns (specifically those attributed to Storm-3121/Storm-3032). These domains are used to lure users into providing credentials under the guise of SSO or passkey setup.
This rule detects phishing emails attempting to impersonate executive roles (CEO, CFO, President) or using ServiceNow-themed lures (invoices, approvals) to solicit unauthorized ACH or wire transfers. The detection logic focuses on suspicious sender domains, payment-related keywords, and executive-specific titles in the email body.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
This rule detects high-volume, burst-pattern email distribution associated with a 'New VM Received' subject line, originating from non-authorized or non-corporate domains. This behavior is indicative of potential mass phishing or spam campaigns mimicking automated voicemail notifications.
This rule detects DNS queries for suspicious domains that mimic MFA or passkey registration portals. Such domains are often used in phishing campaigns to lure users into registering their credentials or security tokens on adversary-controlled infrastructure.
Detects Microsoft Teams communication (calls, chats, messages) originating from a different tenant where the sender's display name is identified as IT Support, Help Desk, or similar. This behavior is indicative of external actors attempting to impersonate internal IT staff to facilitate social engineering or credential harvesting.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Page 22 of 83