Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule monitors for HTTP traffic directed at .vu TLD domains, which contain the specific Cloudflare 'Just a moment' browser-check page. This pattern is characteristic of the NovaCookies Phishing-as-a-Service (PhaaS) platform, which uses such gates to prevent automated analysis and security scanners from accessing the final phishing page.
This rule detects JavaScript code patterns indicative of the NovaCookies phishing kit, which employs timing-based anti-analysis techniques to detect if a web developer console is open. By checking the execution time of code via a 'clock' function and monitoring for a 'debugger' statement, the kit attempts to withhold the phishing lure from researchers.
Detects the execution of the PhishLocker module, a component of the SynkLoader malware. This module is designed to display a fake, full-screen Windows lock-screen overlay to conduct credential phishing. The rule identifies processes exhibiting the 'Main Window' title associated with these malicious DLLs (msvcp150.dll or msvcp160.dll) that are typically used for sideloading.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Correlates email delivery, URL click telemetry, endpoint network connections, and process execution evidence for one or more suspicious URLs or domains.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
Detects Windows Internet Shortcut (.url) files that contain suspicious lures and direct users to Microsoft device code authentication endpoints (devicelogin), characteristic of ARToken phishing campaigns hosted on anonymous SharePoint shares.
This rule monitors for incoming emails containing suspicious attachments (such as .htm, .xhtml, .svg, or QR codes) associated with common business-related subject lines or file names (e.g., 'contract', 'agreement', 'edocs'). It specifically identifies emails originating from 'amazonses.com' that do not match expected trusted domains like DocuSign or Workday, indicating a potential credential harvesting or phishing attempt.
Detects instances where Microsoft Teams logs report a message containing a 'Malicious url'. This suggests a potential phishing attempt via Teams, where a user is being sent a link classified as malicious by security systems.
Detects PDF documents that impersonate Notion invitation notifications and incorporate multiple redundant/overlapping URI links. This technique is used by the threat actor DOUBLOON DREDGER to facilitate EvilTokens device code harvesting campaigns.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Inbound email campaigns containing links to external personal SharePoint sites (*-my.sharepoint.com) sent to multiple recipients.
Detects malicious PDF attachments that masquerade as DocuSign remittance advice notifications. These PDFs contain embedded hyperlinks (via /URI or /Link action annotations) designed to redirect users to malicious external sites rather than legitimate DocuSign services, commonly used in phishing campaigns.
Provides a consolidated view of email metadata, delivery outcomes, attachments, embedded URLs, sender infrastructure, and security verdicts for inbound and outbound email investigations.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
The query enriches email events with attachment and URL data, allowing analysts to quickly assess:
Sender and recipient information
Delivery actions
Phishing and spam verdicts
URLs contained within messages
Attached files and hashes
Threat classifications
Sender IP infrastructure
This query is useful for phishing investigations, malware delivery analysis, threat hunting, and message trace reviews.
Detects a sequence of events where a user interacts with a suspected fraudulent CAPTCHA or slider gate on an non-allowlisted domain, followed by interaction with a spoofed Microsoft 365 login page on the same device within 15 minutes. This behavior is characteristic of the Mirage2FA phishing kit, which intercepts credentials and MFA tokens in real-time.
Detects inbound emails containing password-protected archives (rar, zip, 7z) from either common freemail providers or domains matching known social engineering themes (e.g., webinar, interview, research). The rule specifically flags emails where the subject or body includes password hints (e.g., 'pwd', 'extract', 'unzip') indicating an attempt to deliver malicious payloads while evading email gateway inspection.
This rule detects user interaction with potentially malicious URLs from known Dynamic DNS (DDNS) providers or URLs containing suspicious keywords frequently associated with phishing lures (e.g., login, auth, verify, mfa). It filters out known legitimate Microsoft domains to reduce noise.
Detects the execution of rundll32.exe with command-line arguments involving shell32.dll and SHCreateLocalShellFolderServer, which is associated with phishing lures. The rule correlates this execution with either a direct child relationship to web browsers (Chrome, Edge) or proximity in time to the execution of Microsoft Outlook, indicating potential spearphishing or web-based delivery of malicious payloads.
Detects Zscaler ZIA logs identified as Advanced Threat Protection events, specifically targeting URL categories like Phishing and WebSpam, or traffic classified as Advanced Security Risk. The rule aggregates these events by user to identify potential malicious activity, flagging sessions where threats were allowed as higher severity.
Identifies suspicious inbound bulk email campaigns by correlating sender behaviour, recipient spread, URL evidence, Safe Links click telemetry, external SharePoint links, post-delivery remediation actions, and campaign delivery outcomes.
The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions.
It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction.
Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions.
It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction.
Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Page 43 of 83