Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,437
11,828
5,871
5,150
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
This rule detects DNS queries and TLS SNI traffic directed towards identified phishing or malicious domains that mimic Passkey, Single Sign-On (SSO), or help desk authentication portals. These domains are commonly used by attackers for credential harvesting or adversary-in-the-middle (AiTM) phishing attacks targeting organizational authentication services.
Detects internal phishing messages sent via Microsoft Teams that contain common credential-harvesting lures (e.g., passkey, MFA, SSO updates) where the sender account has also exhibited indicators of compromise within the preceding 24 hours, such as risky sign-ins or impossible travel.
Detects DNS queries for suspicious domains that use keywords typically associated with credential harvesting, passkey-based phishing, or rogue SSO/authentication portal setups. The rule flags domains containing terms like 'passkey', 'oktasession', 'keysync', and various 'setup' or 'connect' variations designed to deceive users into providing authentication credentials.
Detects Microsoft Teams messages containing urgent language and themes related to passkey or SSO updates, which are indicative of a phishing attempt aimed at harvesting credentials or performing account takeover.
Detection of DNS queries, TLS SNI, and HTTP Host headers matching domains associated with Storm-3121 and Storm-3032 phishing campaigns. These campaigns mimic identity, SSO, and passkey registration processes to capture credentials or perform token theft.
Detects internal Microsoft Teams messages containing lures related to passkey or SSO enrollment, which is indicative of a compromised account attempting to perform lateral phishing to harvest credentials or bypass multi-factor authentication.
Detects instances of OAuth device code flow authentication from suspicious sources (e.g., unfamiliar devices, non-compliant/unmanaged devices, or unusual geographic locations) that are followed closely by an OAuth application consent event. This behavior is indicative of potential consent phishing or device code phishing attacks attempting to gain persistent access to cloud resources.
This rule monitors network connections for specific domains and URL patterns associated with the 'FlowerStorm' campaign. It flags potential phishing attempts by identifying low-prevalence connections to known malicious infrastructure from browser or PDF reader processes.
Detects the Iron Man System phishing kit via its HTTP fingerprint: a request-header rule (ETag/Server/Via combo) checked on the external server's response, and three request-side rules checking for the kit's hashed asset paths and favicon when an internal host requests them from an external site. Fixed a direction bug on the three request-side rules that had source/destination reversed (they previously required an external host to request the path from an internal server, which would rarely if ever fire).
Detects the Iron Man System phishing kit via its HTTP fingerprint: a request-header rule (ETag/Server/Via combo) checked on the external server's response, and three request-side rules checking for the kit's hashed asset paths and favicon when an internal host requests them from an external site. Fixed a direction bug on the three request-side rules that had source/destination reversed (they previously required an external host to request the path from an internal server, which would rarely if ever fire).
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects a high volume of outbound emails (more than 20 within a one-hour window) from a single sender containing the subject line 'Payment Transaction Failed Reminder', which is a common pattern for phishing or social engineering campaigns.
Detects inbound emails masquerading as reputable advisory firms (PwC or KPMG) using lookalike sender domains, combined with wire-transfer fraud phrases in the subject line. Correlates with identity logon telemetry for the same fraudulent WhatsApp Business phone number, enabling detection across both email and authentication channels. Note: message body content is not available in the EmailEvents schema, so fraud-phrase matching is subject-only.
Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
This rule monitors DNS and email traffic for domains ending in .shop that fuzzy-match against a predefined watchlist of corporate brand names. This behavior is commonly associated with phishing campaigns, brand impersonation, or typosquatting, where attackers use similar-looking domains to lure users into revealing sensitive information or credentials.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
This rule detects network communication, email interaction, or identity logon events related to known spoofed IC3 (Internet Crime Complaint Center) domains used in business email compromise (BEC) campaigns. The detection covers multiple telemetry sources including email URL information, device network events, and identity logon logs to identify attempts to interact with fraudulent portals.
Page 29 of 83