Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects potential phishing attempts by identifying emails with subject lines and attachment names related to Income Tax or official tax filings. The detection logic correlates indicators such as specific tax-related subject phrases, common tax utility attachments, suspicious URLs (govtop.one), and sender spoofing (impersonating 'Government of India' without a valid .gov.in domain).
This rule detects potential credential harvesting or malware delivery by identifying an email client (e.g., Outlook) launching a PDF reader, which subsequently executes a web browser. This sequence is a common indicator of a user interacting with a malicious link or 'Sign' button inside a PDF attachment opened directly from an email.
This rule detects potentially malicious search queries within Microsoft 365 or Copilot-related URLs intercepted by email gateways, proxies, or SIEM sources. It monitors for suspicious query parameters that may indicate attempts to hide malicious content, such as HTML tags (e.g., <img>), image-related keywords, or excessively long query strings, which could be indicative of phishing attempts or browser-based exploitation techniques.
This rule detects potentially malicious email attachments masquerading as 'Distribution Settlement Agreements'. It flags PDF attachments that match these specific filenames when delivered in emails associated with identified suspicious domains (gasparinutrition.com, gappssmtp.com) or when authentication checks like DMARC fail.
Detects spearphishing emails targeting high-value executive recipients (CEO, CFO, etc.) that contain PDF attachments and use subject lines related to settlement or distribution agreements. The rule specifically looks for inbound traffic routed through Google Workspace (gappssmtp.com) infrastructure, indicating potential use of compromised legitimate domains to distribute malicious lures.
Detects external Microsoft Teams calls involving screen sharing and impersonation of trusted entities. This rule identifies high-risk credential theft or RAT installation vectors by filtering for calls where screen sharing occurs and the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or impersonates common trusted entities like 'microsoft', 'helpdesk', 'it.support', 'admin', 'security.team', 'apple', 'google', 'amazon', 'paypal', 'bank', etc.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Detects endpoint browser and email client processes initiating network connections to domains and IP addresses associated with HolaBrief and LoopedIn open-redirect infrastructure, commonly leveraged in invoice-themed phishing campaigns.
Detects potential phishing activity involving a two-hop open-redirect chain. The rule monitors for an initial navigation to known SaaS platforms (HolaBrief or LoopedIn), followed within one minute by an outbound request to an external destination where the SaaS domain is present in the HTTP referrer header, indicating a redirect-based phishing mechanism.
Detects internal emails with subject or body content related to payroll information changes (e.g., direct deposit, bank account redirection) sent to HR or payroll-related email addresses or recipients. This behavior is indicative of internal Business Email Compromise (BEC) or an attempt by an attacker (or compromised insider) to facilitate payroll fraud.
Detects high-risk activity where a user session, characterized by specific suspicious browser user agents and non-interactive authentication (indicative of token replay/session hijacking), is followed by changes to Workday payroll information (direct deposit, banking details) or unauthorized access to HR-related email content.
This rule detects network connections and email URLs that match known typosquatted patterns of Microsoft domains. It aims to identify potential phishing attempts or traffic directed to infrastructure used by the 'Bulletproof Redirect Engine' masquerading as legitimate Microsoft services. The logic filters out legitimate Microsoft-related URLs to minimize false positives.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
This rule detects extortion emails that claim corporate data theft and threaten public release unless a cryptocurrency payment is made. It looks for a combination of breach-related subject lines, extortion-specific language in the email body, and indicators such as specific cryptocurrency mentions, urgent deadlines, usage of anonymous email providers, or references to attached proof of compromise.
Detects phishing emails sent from personal Gmail accounts that use URL shorteners, include urgency-based legal lures in the subject line, and pass SPF/DKIM/DMARC authentication checks. The rule looks for indicators of spearphishing attempts leveraging social engineering and common evasion techniques like BCC delivery to bypass standard security filters.
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing TLDs, indicating potential phishing attempts or the use of Phishing-as-a-Service (PhaaS) infrastructure. The rule specifically targets one-on-one chats and filters for a broad list of suspicious top-level domains.
Device Code Phishing Attempt
Cortex XDR
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of a phishing attack where an adversary is trying to gain access to a user's application access token.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Page 50 of 83