Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
This rule detects the creation of files with naming conventions associated with common document-based phishing lures (e.g., invoices, fiscal documents) or DNS requests to specific domains (e.g., pages.dev) frequently leveraged by attackers for hosting malicious content.
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing TLDs, indicating potential phishing attempts or the use of Phishing-as-a-Service (PhaaS) infrastructure. The rule specifically targets one-on-one chats and filters for a broad list of suspicious top-level domains.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
Detects phishing emails associated with the TONResolver campaign that impersonate Booking.com guest complaints. The rule identifies suspicious emails containing .ics calendar file attachments or links to domains matching the pattern 'photo-[0-9]+.cfd', primarily targeting hospitality staff with subject lines related to hotel inquiries or issues.
Detects phishing emails impersonating Booking.com, specifically targeting Japanese users with malicious .cfd domains, suspicious subject lines, or attachments like 'invite.ics'. The rule assigns risk scores based on specific indicators such as URL patterns, body text, and sender domains.
Detects spearphishing emails delivered through Google Workspace infrastructure that fail DMARC strict alignment check. Specifically, this monitors instances where the DKIM signing domain is a gappssmtp.com subdomain that fails alignment with the envelope sender domain, while concurrently carrying a PDF attachment, consistent with known phishing campaign patterns.
This rule detects potential email spoofing or relay abuse by identifying emails that claim to be from the 'gasparinutrition.com' domain but fail DMARC authentication, despite showing a DKIM pass status specifically associated with 'gappssmtp.com' subdomains. This behavior is indicative of an adversary attempting to bypass email authentication mechanisms by leveraging legitimate third-party mail relay infrastructure to send spoofed messages.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule monitors incoming email events for a specific domain or sender address, detecting instances where emails pass DKIM validation but fail DMARC and SPF checks while simultaneously being flagged as spam by the email security solution. This pattern is indicative of potential spoofing or unauthorized email activity.
Detects incoming emails purportedly from a specific domain ('gasparinutrition.com') that exhibit signs of spoofing or malicious activity. The rule looks for DMARC failures, DKIM misalignment, and presence of specific document attachments or subject lines (e.g., 'Distribution Settlement Agreement') that mimic business correspondence often used in social engineering or phishing campaigns.
This rule detects two suspicious activities within a user's mailbox: (1) An email flood, where a recipient receives more than 500 emails within a 5-minute window, potentially indicating an attempt to overwhelm or hide secondary emails; and (2) The creation or modification of inbox rules that include actions like deleting or moving messages, which is a common persistence and evasion technique used by attackers to hide C2 or phishing communications.
This rule detects network activity and email signals associated with a malicious campaign promoting a fraudulent 'Perplexity AI' Chrome extension. It monitors for connections to known malicious Tilda landing pages, correlates these visits with subsequent Google Chrome extension (CRX) downloads within a 10-minute window, and identifies phishing emails containing links to these malicious pages.
Detects HTTP GET requests to the /api/device/gate/ path, a specific behavior associated with EvilTokens phishing kits. Attackers use this gate check endpoint to identify and potentially burn active phishing sessions for security researchers or automated scanners.
Detects web traffic containing HTTP 301/302 redirects to known cloud hosting platforms (Azure, AWS, Cloudflare) that exhibit suspicious URL patterns or originate from identified malicious referrers associated with phishing or credential harvesting campaigns.
Detects incoming phishing emails that impersonate healthcare-related organizations. The detection identifies malicious activity by matching common healthcare-themed domain patterns in the From header, coupled with email authentication failures (DMARC or DKIM), and a mismatch between the envelope sender and the header From address. It also monitors for invoice-themed subject line lures commonly used in social engineering.
This rule detects invoice-themed phishing emails that impersonate healthcare organizations. It identifies suspicious messages by analyzing email authentication failures (DKIM/DMARC/SPF) and specific delivery conditions like 'compauth=none' or 'reason=451', which are often indicative of phishing campaigns leveraging open redirect services for obfuscation.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
Page 51 of 83