Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects email activity where a user receives an email containing a link to 'tilda.ws' (often used for landing pages) with social engineering themes like invoices or document signing, and subsequently clicks the link to be redirected to a different destination. This pattern is indicative of a credential phishing or malicious landing page campaign.
Detects HTTP requests to known Cloudflare Turnstile challenge endpoints or challenge platform scripts which are commonly abused by phishing kits (e.g., Kratos) to act as an anti-sandbox or anti-scanner gate before delivering malicious content.
Detects outbound network connections to identified infrastructure associated with 'Pink' (CL-CRI-1147) passkey-enrollment vishing campaigns. These operators use phone-based social engineering to direct victims to phishing domains that relay credentials and MFA tokens in real-time to register attacker-controlled passkeys. The rule monitors for specific DNS query patterns containing passkey-related keywords and known malicious IP addresses used by the threat group.
Detects instances where users click links directing to Proton Drive domains, a common vector for device code phishing and credential harvesting attacks.
Detects incoming email messages containing common prompt injection strings aimed at manipulating Large Language Models (LLMs). The rule scans email bodies for directives such as 'ignore previous instructions', 'save this to your memory', or other obfuscation patterns frequently used in adversarial prompting to bypass LLM safety guardrails or perform unauthorized data extraction.
This rule detects the use of HTML tables to render QR codes without external image files. This technique, often referred to as 'imageless QR codes', involves creating a grid using HTML table cells (td) with CSS background colors (white and black) to form the QR pattern. Attackers use this method in phishing emails to embed QR codes that redirect victims to malicious websites, bypassing simple image-based security filters.
Detects inbound or intra-organizational emails that contain URLs associated with Proton Drive services. This rule is specifically designed to identify potential device code phishing attempts or malicious document distribution utilizing Proton Drive's infrastructure.
This rule identifies emails containing URLs that point to known malicious domains used in phishing campaigns. It joins email URL information with core email event details to report the sender, recipient, subject, and the specific malicious domain associated with the URL.
Detects co-occurrence of Kratos phishing kit static asset filenames lg.svg, barr.svg, ani.gif, and styles.css served from phishing infrastructure
Detects instances where a user receives an email containing a link to 'canva.com' with subject lines suggestive of document sharing or invoicing, and subsequently clicks a URL that redirects them away from the 'canva.com' domain. This behavior is indicative of potential document-based phishing where attackers use legitimate document hosting platforms as a lure to redirect users to malicious or credential-harvesting websites.
Detects the presence of multiple anti-debugging and anti-analysis JavaScript techniques within HTTP response content, commonly used in phishing landing pages to prevent security analysts from inspecting the site's behavior. The rule specifically looks for combinations of event listeners for the context menu, disabling F12 developer tools, debugger timing-loop checks, and automatic 'about:blank' redirects upon pause detection.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Detects static HTML/JS/CSS artifacts matching the DEBULL device-code phishing template via admin.css SHA256, Composer content-hash, and Turkish-language code markers
This rule detects incoming emails containing specific subject lines related to 'Request for Payment' and 'Shared Folder' that include links to the '/Team_Meets/' path. It flags instances where the sender's domain differs from the domain hosting the embedded link, which is a common indicator of phishing or credential harvesting attempts using domain masquerading.
Detects potential Microsoft Teams impersonation or social-engineering activity where accounts use IT, admin, support, or security-themed display names, especially when associated with external users or impersonation indicators.
This rule detects HTTP POST requests to known phishing domains (frenksv.sbs, debull.app) which include specific parameters indicative of an attempt to initiate the OAuth 2.0 device authorization grant flow ('get_auth_broker_device_code'). This pattern is associated with phishing campaigns aiming to hijack a user's session by tricking them into authorizing a malicious application, eventually leading to the theft of application access tokens.
Detects inbound emails with document-related subjects that contain links to the systeme.io platform, which are subsequently clicked and redirected to a different destination. This pattern is commonly used in phishing campaigns to bypass initial security inspection by leveraging reputable hosting platforms as a redirector.
This rule monitors network HTTP header traffic for specific strings commonly associated with social engineering, scamming, or phishing campaigns, such as '4.8-star' ratings or 'over 2 million users' claims, which are often used to deceive users into interacting with malicious content.
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
Detects spearphishing emails that contain both a link to the legitimate 'microsoft.com/devicelogin' page and the phrase 'device code'. This is a common social engineering tactic used to trick users into providing a device authorization code to an attacker, enabling them to bypass MFA and hijack user sessions via OAuth device code flow.
Page 46 of 83