Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects inbound emails that appear to be Microsoft Teams invitations but contain suspicious keywords in the subject line related to financial transactions (invoice, billing, payment, renewal, charge). This could indicate a phishing attempt where adversaries leverage legitimate-looking Microsoft invitation emails to deliver financially themed lures.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Detects DNS lookups or network connections from common web browsers to known malicious or suspicious domains (short.gy and chongdaotang.net), which are associated with legal-threat lure phishing campaigns designed for credential harvesting.
This rule uses regular expressions to identify distinct URL structures associated with the Tycoon2FA AiTM (Adversary-in-the-Middle) phishing kit. Specifically, it looks for URIs containing patterns like "?auth=" followed by a base64-encoded string or "/login?email=" followed by a base64-encoded string, which are indicative of the kit's operation to capture credentials or session tokens.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects a sequence of events indicative of a successful phishing attack: a user receives an email containing a suspected phishing URL, clicks the URL, and subsequently performs a successful sign-in from an IP address not seen in their recent 14-day history within 15 minutes of the click.
This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.
Detects inbound emails containing attachments with file extensions commonly used for HTML/SVG smuggling (.html, .htm, .svg, .shtml, .xhtml). This technique is often used to bypass email security filters by assembling malicious payloads client-side after the email has been delivered. The rule specifically looks for inbound emails where the attachment has not been blocked or junked by the email gateway.
This rule detects potential phishing attempts where users receive SharePoint sharing invitations or links from external tenants that are not part of the organization's trusted SharePoint environment. It identifies inbound emails from SharePoint notification senders containing URLs to external SharePoint tenants and also flags internal SharePoint sharing events (invitations or anonymous link creations) initiated by accounts whose domain differs from the home tenant. This could indicate an attacker attempting to lure users to malicious external SharePoint sites or using compromised accounts to facilitate external sharing.
This rule detects network connections to phishing pages hosted on the workers.dev domain that are attempting to interact with EvilTokens device code API endpoints. These pages are known to implement developer hotkey prevention (F12 blocked, context menu disabled) to hinder in-browser analysis, indicating malicious intent.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. Specifically, it looks for emails where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' but differs from 'SenderMailFromDomain' (P1 envelope), and the email was successfully delivered.
This rule identifies potential mass phishing campaigns by monitoring O365 email activity for high-volume outbound mail from newly registered or observed domains. It specifically flags senders that have no prior historical activity in the last 90 days, have a domain age of less than 30 days, and exhibit a low variation in email subjects across a large volume of recipients, which is characteristic of automated bulk phishing.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
This rule detects potential spear phishing campaigns by identifying a high volume of emails (10 or more within an hour) from external senders (not @company.com) that contain keywords like 'password', 'account', or 'security' in the subject line, and also include either an attachment or a URL. This combination of factors suggests a targeted social engineering attempt.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
Detects inbound email patterns characteristic of the Kali365 campaigns, containing instructions and formatting that prompt users to enter a specific device code. The rule identifies emails with specific subject line keywords and URLs pointing to microsoft.com/devicelogin.
This rule identifies phishing emails containing multiple distinct redirect hops across various cloud hosting platforms (e.g., Azure Websites, Firebase, CloudFront). It flags emails as suspicious if they contain URLs from multiple monitored cloud platforms, indicating a likely bulletproof redirect chain, and correlates these emails with click data. It elevates the severity for emails sent to privileged user accounts such as admins, executives, or finance staff.
Page 52 of 83