Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,437
11,828
5,871
5,150
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects network activity (HTTP requests or DNS queries) interacting with specific suspicious domains that mimic Microsoft 365, Purview, or DocuSign authentication pages. These domains are identified by specific naming patterns and content markers indicative of credential harvesting or device code phishing attacks.
This rule identifies network activity, email URLs, and DNS queries associated with a specific set of known malicious domains often used in phishing or credential harvesting campaigns. By aggregating telemetry from EmailUrlInfo, EmailEvents, DeviceNetworkEvents, and DnsEvents, the rule flags any interactions with these indicators of compromise.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects phishing emails containing URLs with IPv6-mapped IPv4 addresses (e.g., [::ffff:192.168.0.1]). Adversaries use this obfuscation technique to bypass security filters that may not correctly parse or normalize IPv6-mapped addresses within URLs.
Detects coordinated email phishing campaigns by normalizing email subjects to identify recurring templates and flagging those sent to a high volume of recipients across multiple organizations within a short timeframe. The rule specifically targets financial and urgent pretexts from external senders, similar to observed techniques in impersonation campaigns.
Detects DNS queries, TLS SNI, and HTTP Host header traffic associated with the IronToll phishing campaign. The rule specifically monitors for government-impersonating domains and lookalike domains utilizing various non-standard top-level domains (TLDs).
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
This rule detects potential phishing activity by correlating specific email subjects or sender addresses with subsequent user clicks on suspicious links. It identifies when users receive emails with subjects related to invoices or payment confirmations, or from specific known-bad sender domains, and then follows up by tracking interactions (clicks) with domains or patterns associated with the phishing lures (SharePoint, Adobe, verification, or device code login URLs).
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects user sign-ins using the OAuth 2.0 Device Code authentication flow in Entra ID. This flow, designed for input-constrained devices, is frequently abused by attackers in 'Device Code Phishing' (or ARToken) campaigns to steal session tokens and bypass MFA by tricking users into authorizing a malicious application via a web portal.
Detects phishing emails leveraging finance or accounts-payable themes (e.g., invoices, payment confirmations, bank detail updates) that contain known ARToken phishing template strings. This activity is indicative of credential harvesting via device code authorization flow abuse.
Detects artifacts, domains, and web content associated with the Rapuncel MaaS phishing campaign. The rule specifically targets HTML/JS markers from fake LastPass Authenticator GitHub Pages sites, which employ social-engineering tactics such as fake trust badges and malicious download prompts to distribute the Rapuncel infostealer.
Detects multiple anomalous sign-in events using the device-code authentication flow within an Entra ID tenant. The rule correlates sign-ins from geographically disparate IP addresses (often associated with known attacker infrastructure or proxies) using device-code flows, which is a technique used in 'ARToken' style phishing campaigns to compromise multiple user accounts in a short timeframe.
Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Page 27 of 83