Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,437
11,828
5,871
5,150
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects phishing emails that impersonate DocuSign by containing both an .ics calendar file attachment and a link directing users to the Microsoft login OAuth authorization endpoint, often indicative of credential or token harvesting.
This rule monitors network, DNS, and email activity to identify communication or references to a set of known malicious domains associated with threat activity. It consolidates logs from device network events, DNS queries, and email telemetry (URLs and sender domains) to detect potential compromise or phishing attempts.
Detects phishing emails containing URLs with IPv6-mapped IPv4 addresses (e.g., [::ffff:192.168.0.1]). Adversaries use this obfuscation technique to bypass security filters that may not correctly parse or normalize IPv6-mapped addresses within URLs.
This rule monitors network, DNS, and email activity to identify communication or references to a set of known malicious domains associated with threat activity. It consolidates logs from device network events, DNS queries, and email telemetry (URLs and sender domains) to detect potential compromise or phishing attempts.
Detects incoming emails from specific suspicious domains that pass authentication checks (SPF, DKIM, DMARC) but contain subject lines commonly associated with phishing campaigns, such as invoices, payment requests, or urgent notifications. The rule includes associated URL and attachment information for further analysis.
Detects phishing attempts related to 'Operation DoppelBrand' campaign using common email service providers (ESPs) to spoof legitimate-looking emails with fraud-themed subjects, such as invoices or payment requests, associated with the Brickstorm malware.
Detects inbound emails that spoof ServiceNow branding or impersonate high-level organizational roles (e.g., CEO, VP, President) in the display name while using common reply/forward subject headers. The rule specifically flags these if the sender domain does not originate from a legitimate service-now.com domain and contains PDF or HTML attachments, which are common vectors for credential harvesting or malware delivery.
Detects inbound emails that pass SPF, DKIM, and DMARC authentication checks but contain attachments (PDF, HTML, DOCX, XLSX, SVG) with subjects commonly used in phishing lures such as DocuSign, shared documents, invoices, or HR announcements.
This rule detects potential large-scale phishing campaigns by identifying email traffic patterns involving URLs hosted on the 'workers.dev' domain. It looks for a high volume of unique recipients and unique subject lines within a short timeframe, which is indicative of automated, mass-distributed phishing lures often used to evade traditional URL reputation filters.
Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.
This rule monitors DNS queries and HTTP traffic for indicators related to known phishing infrastructure impersonating passkey and SSO providers. The domains detected are associated with Storm-3121/3032 campaigns designed to facilitate credential or session harvesting.
Detects potential social engineering attacks in Microsoft Teams where an internal user sends multiple messages containing terms related to MFA, SSO, or passkey updates, potentially attempting to harvest credentials from other users.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects high-volume, potentially malicious email campaigns characterized by discount-themed subject lines containing keywords like '65% off' and links pointing to '.shop' domains. The rule identifies suspicious patterns by aggregating events and flagging instances where multiple users are targeted with similar subjects and domains, excluding those specifically allowlisted.
Detects forged NDA documents used in Phantom Deal fake acquisition fraud, requiring corroborating secrecy-clause language and M&A-fraud-specific wire-transfer/payment phrasing alongside impersonated advisory brands
Detects instances where a user successfully authenticates using the OAuth Device Code flow followed by subsequent mailbox operations (such as reading, sending, or deleting items) from a different IP address within a 10-minute window. This behavior is a strong indicator of adversary-in-the-middle phishing attacks where an attacker captures a session token and utilizes it from a remote location.
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
This rule detects activities associated with the GhostCode phishing kit, which leverages a device-code phishing flow. It identifies malicious URLs interacting with harvester APIs to retrieve codes, email-delivered lures containing specific phishing markers ('userCodeDisplay', 'Verified Enterprise'), and corresponding endpoint/browser telemetry showing the rendered phishing page elements.
Page 30 of 83