Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
This rule detects network connections or DNS queries to known phishing domains (typosquatted Microsoft login domains), DeadDrop Resolver domains, and suspicious HTML payloads served from common CDN/package hosting sites (e.g., unpkg.com, npmmirror.com, cdn.jsdelivr.net, yarnpkg.com). These patterns are indicative of initial access attempts via phishing or the secondary stage of malware C2 communication.
This rule performs a comprehensive hunt for activities associated with the MuddyWater (also known as Boggy Serpens) threat group, specifically relating to their 'Operation Olalampo' campaign. It monitors for spearphishing artifacts (lure documents and attachments), execution of specific malware and drop artifacts, the use of LOLBins by Office applications, unauthorized remote access via AnyDesk, Telegram-based C2 communication, and persistence mechanisms such as registry run keys and specific file extensions (.wdlp).
Detects Microsoft Teams messages sent from an onmicrosoft.com domain that impersonate an 'IT Service Desk' and contain a link to an .msi file hosted on Azure Blob Storage, a common indicator of a phishing lure distributing malicious installers.
This rule detects a correlation between an email phishing burst (high volume of emails with a specific failed payment subject) and the subsequent creation of suspicious 'x_trace_' files in 'var/report/' directories. This pattern is indicative of a phishing campaign where a malicious attachment or link might be attempting to write local tracking or diagnostic files on a victim's host.
This rule detects a correlation between an email phishing burst (high volume of emails with a specific failed payment subject) and the subsequent creation of suspicious 'x_trace_' files in 'var/report/' directories. This pattern is indicative of a phishing campaign where a malicious attachment or link might be attempting to write local tracking or diagnostic files on a victim's host.
Detects messages sent, chats created, or members added within Microsoft Teams that involve external participants and contain embedded HTTP or HTTPS links. This behavior is indicative of potential external spearphishing or malicious link distribution through collaborative chat platforms.
Detects Direct Send bypass (null envelope + internal-domain spoof) using a file/document-sharing lure aimed at leadership. Tightened: added inbound-direction and auth-failure requirements (was previously missing any authentication check, so legitimate SharePoint/OneDrive-style sharing notifications from real internal senders could have matched), delivered-only filter, and case-insensitive recipient/job-title join.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects SCL-9 (high-confidence phishing/spam) messages that still reach an inbox, indicating an allow-list or transport-rule override, and enriches with any recent tenant mail-flow admin changes. Rewritten: removed a no-op self-join on EmailEvents and a broken exact-match join against CloudAppEvents' raw audit blob (was comparing a sender address against a whole JSON record and would never match); now excludes messages later auto-remediated (e.g. ZAP-quarantined) via the native LatestDeliveryLocation field, and correlates admin rule/allow-list changes via substring match over a cross join.
Detects SCL-9 (high-confidence phishing/spam) messages that still reach an inbox, indicating an allow-list or transport-rule override, and enriches with any recent tenant mail-flow admin changes. Rewritten: removed a no-op self-join on EmailEvents and a broken exact-match join against CloudAppEvents' raw audit blob (was comparing a sender address against a whole JSON record and would never match); now excludes messages later auto-remediated (e.g. ZAP-quarantined) via the native LatestDeliveryLocation field, and correlates admin rule/allow-list changes via substring match over a cross join.
Detects the RejectDirectSend bypass (null SMTP envelope sender + internal-domain spoof). Tightened to require Microsoft's composite auth verdict OR all of SPF/DKIM/DMARC failing (vs. any one), excludes known-approved Direct Send relay IPs, and excludes likely-legitimate bulk/newsletter traffic via BulkComplaintLevel.
Detects inbound emails where the sender domain mimics finance-themed brands (using a regex-based pattern) and includes URLs redirecting through the ActiveCampaign platform tracking domains (activehosted.com or acemlnd.com). This rule identifies potential phishing campaigns attempting to use legitimate email marketing infrastructure to bypass reputation-based filters.
This rule identifies phishing attempts by detecting inbound emails where the sender's domain or any embedded URLs within the email content match a pre-defined list of known malicious domains. It flags emails for further investigation by correlating sender domain data and URL information found in the email communication.
This rule detects incoming emails that contain common phishing lure keywords or reference ID patterns in the subject line, combined with signs of email spoofing (same sender/recipient domain) or a failure in email authentication protocols (DKIM, SPF, or DMARC).
This rule correlates successful Microsoft 365 sign-in events with preceding network events involving identified NovaCookies AiTM phishing infrastructure (specifically targeting .vu domains or specific URL patterns). It triggers when a user successfully authenticates using MFA shortly after accessing a known phishing link, which is a strong indicator of an active AiTM session hijacking attempt.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule monitors network connections for specific domains and URL patterns associated with the 'FlowerStorm' campaign. It flags potential phishing attempts by identifying low-prevalence connections to known malicious infrastructure from browser or PDF reader processes.
This rule monitors network connections for specific domains and URL patterns associated with the 'FlowerStorm' campaign. It flags potential phishing attempts by identifying low-prevalence connections to known malicious infrastructure from browser or PDF reader processes.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Page 41 of 83