Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects inbound emails or URL click events that contain specific keywords associated with the PREY-0058 vishing campaign. These keywords are used to lure victims to attacker-controlled pages designed for credential harvesting or MFA/passkey registration.
This rule monitors network connections, DNS resolutions, and email URLs to detect traffic communicating with a known adversary-in-the-middle (AiTM) phishing infrastructure panel. By correlating security logs, DNS events, and email URL data against this specific indicator of compromise, it identifies potential interaction with phishing sites designed to capture credentials or session tokens.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
Detects incoming email messages containing specific suspicious attachment types (.img, .iso) associated with known malicious sender addresses, domains, or specific subject lines indicative of phishing attempts.
This rule detects potential phishing activity by correlating email delivery events and URL click events against a set of known malicious domains and suspicious URL paths. It identifies when a user receives an email containing a suspicious link or interacts with such a link, providing visibility into potential credential harvesting or malware delivery attempts.
This rule detects potential credential harvesting or phishing attempts by identifying specific URL redirection chains that involve a Microsoft login portal, a Microsoft Teams link, and an external third-party CDN domain (cdn.bloom.io). This pattern is consistent with adversary-in-the-middle or credential phishing campaigns designed to bypass security controls by utilizing trusted services for initial delivery.
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
This rule detects phishing emails where the sender's display name impersonates well-known brands (e.g., Microsoft, DocuSign, Zoom) while using a non-official domain. It further correlates these suspicious senders with embedded URLs that either match the targeted brands' domains or contain patterns commonly associated with device code phishing or API verification workflows.
This rule detects sophisticated phishing lure pages impersonating DocuSign or NFe documentation. It specifically identifies pages that implement multi-layered anti-bot gating techniques, including detection of browser automation (navigator.webdriver), identification of headless browser artifacts (headless/HeadlessChrome), and the presence of interaction-wait fallback timers using addEventListener, all tied to specific malicious content indicators.
Detects Direct Send bypass (null envelope + internal-domain spoof) using a file/document-sharing lure aimed at leadership. Tightened: added inbound-direction and auth-failure requirements (was previously missing any authentication check, so legitimate SharePoint/OneDrive-style sharing notifications from real internal senders could have matched), delivered-only filter, and case-insensitive recipient/job-title join.
Detects Microsoft Teams messages containing keywords related to authentication updates, passkey enrollment, or SSO changes combined with urgent language or calls to action (e.g., clicking links). The rule attempts to identify potential credential harvesting or account takeover attempts within the chat platform.
Detects incoming emails containing subject lines, body text, or URLs related to passkey, SSO, or MFA configuration updates. These indicators are often used in social engineering campaigns to lure users into providing credentials on fraudulent login pages.
Detects DNS resolutions, TLS SNI, and HTTP host requests to known malicious phishing domains impersonating passkey and SSO infrastructure, often associated with Storm-3121/Storm-3032 activities.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
This rule monitors email traffic for communication involving identified malicious domains and sender addresses. It cross-references sender information in the EmailEvents log with a predefined set of suspicious domains and email addresses, highlighting potential phishing or malicious outreach attempts.
This rule identifies potential phishing emails that impersonate OneDrive sharing notifications. It correlates email messages containing keywords typically associated with document sharing (e.g., 'OneDrive', 'shared', 'file') with subsequent user URL clicks. Crucially, the rule filters for clicks to domains that are not explicitly related to legitimate OneDrive, SharePoint, or 1drv.ms hosting, indicating a potential attempt to lure users to a malicious third-party site under the guise of file sharing.
This rule detects potential phishing activity by correlating email delivery events and URL click events against a set of known malicious domains and suspicious URL paths. It identifies when a user receives an email containing a suspicious link or interacts with such a link, providing visibility into potential credential harvesting or malware delivery attempts.
This rule monitors for inbound email activity containing sender domains or embedded URL domains known to be associated with malicious phishing campaigns. It flags emails matching a predefined list of suspicious sender domains or URLs that resolve to known malicious infrastructure.
This rule monitors for a multi-stage attack pattern involving two potential indicators: first, it identifies phishing emails containing a 'Google Docs' link combined with an attachment named 'API Logic Flaw'. Second, it detects browser activity involving the paste of JavaScript code or suspicious browser clipboard activity, which may indicate an attacker attempting to execute malicious scripts directly in the user's browser context.
Page 33 of 83