Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,432
11,818
5,871
5,150
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects network connections or DNS queries to known phishing domains (typosquatted Microsoft login domains), DeadDrop Resolver domains, and suspicious HTML payloads served from common CDN/package hosting sites (e.g., unpkg.com, npmmirror.com, cdn.jsdelivr.net, yarnpkg.com). These patterns are indicative of initial access attempts via phishing or the secondary stage of malware C2 communication.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
Detects active phishing threat-intelligence indicators whose domain name uses one of the disposable TLDs observed across IronToll's 73+ rotating lookalike domains (.cfd, .sbs, .icu, .buzz, etc.). Scoped to the structured ThreatType classification only — dropped the free-text 'Description has phishing' fallback, since KQL's 'has' is a substring/token match with no negation awareness (e.g. a description stating an indicator is 'not related to phishing' would still match), which could pull in indicators unrelated to actual phishing activity.
Detects incoming emails to finance or accounts payable aliases that contain urgent payment-related keywords and suspicious patterns, such as subject lines including dollar amounts or emails where the Reply-To address domain differs from the Sender domain. This activity is highly indicative of BEC fraud attempts targeting payment redirection.
This rule correlates successful Microsoft 365 sign-in events with preceding network events involving identified NovaCookies AiTM phishing infrastructure (specifically targeting .vu domains or specific URL patterns). It triggers when a user successfully authenticates using MFA shortly after accessing a known phishing link, which is a strong indicator of an active AiTM session hijacking attempt.
This rule detects potential phishing activity by correlating email delivery of Excel attachments with subsequent network connections to known malicious domains initiated by common browser or office processes. It identifies cases where a user may have opened a suspicious Excel file and initiated an outbound network request to a flagged domain within 24 hours of receiving the email.
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
This rule detects network communication, email interaction, or identity logon events related to known spoofed IC3 (Internet Crime Complaint Center) domains used in business email compromise (BEC) campaigns. The detection covers multiple telemetry sources including email URL information, device network events, and identity logon logs to identify attempts to interact with fraudulent portals.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
This rule detects network communication, email interaction, or identity logon events related to known spoofed IC3 (Internet Crime Complaint Center) domains used in business email compromise (BEC) campaigns. The detection covers multiple telemetry sources including email URL information, device network events, and identity logon logs to identify attempts to interact with fraudulent portals.
Detects coordinated email phishing campaigns by normalizing email subjects to identify recurring templates and flagging those sent to a high volume of recipients across multiple organizations within a short timeframe. The rule specifically targets financial and urgent pretexts from external senders, similar to observed techniques in impersonation campaigns.
This rule detects high-volume email bursts sent through third-party bulk email providers where the sender domain exhibits SPF, DKIM, or DMARC alignment failures. This behavior is indicative of mass phishing campaigns, such as those associated with 'Operation DoppelBrand', attempting to bypass email authentication defenses using compromised or unauthorized infrastructure.
Detects successful post-delivery email remediation actions (such as ZAP, manual deletion, or moving to junk) performed on emails associated with the Operation DoppelBrand campaign, identified by specific sender domains (service-nowinc.com, domainlify.net) or suspicious invoice-fraud subject lines.
Detects successful post-delivery email remediation actions (such as ZAP, manual deletion, or moving to junk) performed on emails associated with the Operation DoppelBrand campaign, identified by specific sender domains (service-nowinc.com, domainlify.net) or suspicious invoice-fraud subject lines.
Detects inbound emails that spoof ServiceNow branding or impersonate high-level organizational roles (e.g., CEO, VP, President) in the display name while using common reply/forward subject headers. The rule specifically flags these if the sender domain does not originate from a legitimate service-now.com domain and contains PDF or HTML attachments, which are common vectors for credential harvesting or malware delivery.
Detects inbound emails that spoof ServiceNow branding or impersonate high-level organizational roles (e.g., CEO, VP, President) in the display name while using common reply/forward subject headers. The rule specifically flags these if the sender domain does not originate from a legitimate service-now.com domain and contains PDF or HTML attachments, which are common vectors for credential harvesting or malware delivery.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects forged Citibank payment confirmation/account statement PDFs used in Phantom Deal BPC fraud to falsely demonstrate wire transfer progress; requires combination of bank branding with fraud-specific SWIFT/routing/CTA artifacts
Page 32 of 83