Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,437
11,828
5,871
5,150
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects potential Device Code Phishing (OAuth 2.0 device authorization) attempts by monitoring HTTP requests to the Microsoft device authorization endpoint (login.microsoftonline.com/common/oauth2/deviceauth) that originate from a suspicious referrer domain ending in .de. This behavior is indicative of an attacker-controlled landing page directing users to authenticate their device.
This rule detects potential Device Code Phishing (OAuth 2.0 device authorization) attempts by monitoring HTTP requests to the Microsoft device authorization endpoint (login.microsoftonline.com/common/oauth2/deviceauth) that originate from a suspicious referrer domain ending in .de. This behavior is indicative of an attacker-controlled landing page directing users to authenticate their device.
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
This rule identifies emails containing URLs associated with known suspicious or malicious domains (secboxes.com, msbenefit.com, attcdn.com, brianwilli.com). It filters for instances where the sender's domain is not one of the identified suspicious domains to reduce noise from potential email spoofing or miscategorized communications, flagging potential phishing attempts.
This rule detects potential indicators of compromise related to the 'ATodaPotencia' campaign by monitoring email URL logs, process command-line arguments, and general device events for the string 'ATodaPotencia'. The rule searches across multiple data sources to identify where this specific handle or artifact appears within an environment.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
This rule detects potential social engineering attacks where an attacker initiates a Microsoft Teams call from an external domain while impersonating an internal IT support or help desk entity. The detection specifically correlates this event with a recent preceding email bombing campaign (exceeding 20 emails) targeting the same user within the last 3 hours, indicating a coordinated attempt to pressure or confuse the victim.
Detects DNS queries and TLS SNI traffic associated with known authentication-themed lure domains often used in phishing campaigns. These domains mimic multi-factor authentication (MFA) registration or SSO setup processes to deceive users into credential theft.
Detects outbound network traffic attempting to access lookalike subdomains mimicking Okta or Microsoft 365 identity provider login pages. This behavior is associated with adversary-in-the-middle (AiTM) phishing campaigns, such as those attributed to UNC6671, where attackers use spoofed infrastructure to capture user credentials and session tokens.
Detects outbound network traffic attempting to access lookalike subdomains mimicking Okta or Microsoft 365 identity provider login pages. This behavior is associated with adversary-in-the-middle (AiTM) phishing campaigns, such as those attributed to UNC6671, where attackers use spoofed infrastructure to capture user credentials and session tokens.
This rule identifies emails containing URLs associated with known suspicious or malicious domains (secboxes.com, msbenefit.com, attcdn.com, brianwilli.com). It filters for instances where the sender's domain is not one of the identified suspicious domains to reduce noise from potential email spoofing or miscategorized communications, flagging potential phishing attempts.
Detects potential lateral phishing attempts within Microsoft Teams by identifying a single user account sending messages containing common credential-harvesting lures (e.g., 'passkey', 'SSO', 'MFA', 'security update') to multiple internal recipients in a short timeframe.
This rule detects a correlation between an incoming email, SMS, or message containing phishing lure keywords related to 'passkey' or 'SSO' and 'update' requests, followed by a successful or attempted user sign-in from that recipient within a 2-hour window. This behavior is indicative of a social engineering campaign aimed at credential or token theft.
Detects network traffic (TLS SNI or HTTP Host) to known domains associated with Adversary-in-the-Middle (AiTM) phishing campaigns. These domains mimic passkey, SSO, or account security portals to steal credentials and session cookies.
Detects potential abuse of the device-code authentication flow, which is often used in AiTM (Adversary-in-the-Middle) phishing campaigns. The detection looks for device-code authentication attempts followed by specific error codes (50074, 50140) commonly associated with failures in malicious passkey-themed phishing workflows.
This rule detects potential adversary-in-the-middle (AiTM) or device-code authentication attacks where a user reports suspicious vishing (voice phishing) or SMS lures involving passkeys or SSO updates. The rule correlates user-reported social engineering pretexts with evidence of risky authentication flows, such as device code usage or specific authentication error codes associated with interception.
This rule detects high-volume email bursts sent through third-party bulk email providers where the sender domain exhibits SPF, DKIM, or DMARC alignment failures. This behavior is indicative of mass phishing campaigns, such as those associated with 'Operation DoppelBrand', attempting to bypass email authentication defenses using compromised or unauthorized infrastructure.
Detects inbound emails impersonating IT support or helpdesk staff that utilize urgent pretexts related to passkey, MFA, or SSO updates. These lures are commonly used in phishing campaigns to direct users toward malicious authentication flows, such as AiTM or device-code phishing setups.
Detects a single user account sending an unusually high volume of Microsoft Teams messages containing themes related to passkey, SSO enrollment, or security updates. This behavior is indicative of a compromised internal account being leveraged to propagate social engineering lures to other employees.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects incoming HTTP GET requests targeting known API endpoints associated with the GhostCode phishing kit. These endpoints (/api/harvester) are used by the phishing kit to poll for session details, device codes, or flow identifiers, characteristic of credential harvesting operations.
Page 26 of 83