Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects incoming emails identified as phishing attempts by matching specific sender addresses, subjects related to freight/logistics, or embedded URLs and keywords associated with the 'signindat.com' domain.
This rule detects Microsoft Teams activities such as ChatCreated, MessageSent, or TeamsImpersonationDetected where the sender's display name matches common administrative or support-themed identifiers (e.g., 'IT Support', 'Help Desk', 'Global Admin'). This behavior is commonly associated with social engineering and phishing attempts designed to trick users into divulging credentials or sensitive information by masquerading as trusted enterprise support roles.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
This rule detects potentially malicious email activity that uses recruitment or career-related pretexts to target specific organizations (Boeing, Airbus, Teledyne FLIR). The detection looks for combinations of career-themed keywords in the subject or body of an email that also contain an archive file attachment (e.g., .zip, .rar, .7z) or links, which is a common tactic for delivering malware under the guise of job applications.
KQL Query from file: The Hunt for QR Phisher
Detects inbound emails from external domains that contain both the recipient's job title and their company name in the subject or body, which is a common indicator of targeted spearphishing attacks (BEC/Whaling).
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Detects the creation or update of mailbox inbox rules within 30 minutes of a successful sign-in event using the OAuth device code flow. This sequence is often observed in Business Email Compromise (BEC) attacks where an attacker uses a stolen or phished device code to access a mailbox and subsequently establishes persistence via malicious mail forwarding or deletion rules to hide their tracks.
Detects potential OAuth device code phishing attacks by identifying HTTP requests to the legitimate microsoft.com/devicelogin URL containing suspicious user_code or device_code parameters. This pattern indicates an adversary is using an OAuth device authorization grant flow to steal tokens or gain unauthorized access without the victim needing to provide credentials directly to the attacker.
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Detects phishing attempts using .ics (calendar) files that originate from the 'groups.outlook.com' domain, often used to deliver meeting invites that contain malicious links or social engineering lures.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Detects spear-phishing emails associated with UNC1549, utilizing malicious career-themed lures. The rule identifies emails containing specific lookalike domain patterns related to Boeing, Airbus, or Teledyne FLIR, and correlates these with common recruitment-themed email subjects, HR-spoofing sender strings, or the presence of common compressed file attachments (ZIP, RAR, 7Z, ISO).
This rule detects potential phishing activity by correlating emails containing links to a specific suspicious domain and path with network activity (DNS queries or direct network connections) to the same domain. It targets both the initial email delivery and subsequent user interaction (e.g., clicking the link or downloading files).
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects incoming emails where a single URL contains indicators of two or more distinct security vendor rewriting services. This technique is used by adversaries to create multi-layered redirect chains to bypass automated scanners and deliver malicious content, as seen in Tycoon2FA and Sneaky2FA campaigns.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
This rule detects a multi-stage phishing campaign involving Gmail-hosted emails containing 'short.gy' URLs. It monitors for three distinct signals: (1) Outbound network connections to 'chongdaotang.net', (2) User clicks on 'short.gy' links arriving from Gmail addresses, and (3) Inbound or BCC-delivered emails from Gmail senders containing 'short.gy' links. This combination is highly indicative of a phishing operation attempting to redirect users to a malicious infrastructure.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
Detects the SearchLeak (CVE-2026-42824) delivery vector where a phishing link containing a long encoded 'q' parameter targeting Microsoft 365 Copilot Search is delivered via email to trigger prompt injection and subsequent data exfiltration of sensitive information.
Page 47 of 83