Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,736 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,736
Platforms
1,163
329
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule identifies phishing emails containing multiple distinct redirect hops across various cloud hosting platforms (e.g., Azure Websites, Firebase, CloudFront). It flags emails as suspicious if they contain URLs from multiple monitored cloud platforms, indicating a likely bulletproof redirect chain, and correlates these emails with click data. It elevates the severity for emails sent to privileged user accounts such as admins, executives, or finance staff.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
This rule detects network connections or URL clicks to a list of known malicious domains often associated with phishing or malware distribution. The rule specifically looks for connections to these domains combined with certain URL paths, or direct URL clicks to these domains.
Detects inbound emails that fail SPF, DKIM, or DMARC authentication checks while containing keywords related to invoices or payments in the subject line, and referencing known potentially malicious SaaS URLs (holabrief.com or loopedin.io) in the body or URL fields.
This rule detects potentially malicious web traffic involving a redirect chain associated with HolaBrief and LoopedIn services, which are sometimes leveraged in phishing campaigns or credential harvesting. It identifies multi-hop redirect chains and connections to known suspicious IP addresses (217.182.211.237).
This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.
Detects inbound emails from 'gmail.com' where the sender's display name closely matches the recipient's local username part. This pattern is commonly used in business email compromise (BEC) and phishing attacks to impersonate colleagues or known contacts.
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
Detects emails containing embedded PNG, SVG, or JPG images (often QR codes) that are used in conjunction with a subject line indicating 'Code of Conduct' to bypass text-based URL filters and redirect users to an AiTM (Adversary-in-the-Middle) proxy. This technique is commonly used in phishing campaigns to steal authentication tokens.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies emails containing malicious PDF attachments (e.g., 2026-0610-1.pdf) or directing users to the known phishing domain 'govtop.one', commonly used to harvest credentials or deliver malware.
This rule monitors email metadata for patterns associated with known phishing campaigns mimicking Booking.com. It looks for specific lures in email subjects, suspicious attachment filenames such as 'invite.ics', malicious domains using the .cfd TLD, or body text containing 'Download Photos and Videos'.
Detects activity associated with a specific phishing campaign distributing 'Distribution Settlement Agreement' PDF lures. The rule monitors for file creation or execution of files matching this naming pattern, as well as network connection attempts to domains identified as related to the threat actors: 'gasparinutrition.com' and 'gappssmtp.com'.
Detects email thread fabrication by the Latin-placeholder phishing kit, which embeds specific, non-business job titles and recipient-domain email addresses into the message body to manufacture the appearance of legitimate internal correspondence.
This rule monitors email attachment events for PDF files containing specific, repetitive text patterns often associated with phishing templates or document-based social engineering. It detects attachments that include phrases like 'lorem ipsum' variations or specific professional-sounding but potentially suspicious terms like 'Investor Accounts Producer' or 'Settlement Agreement' which may indicate an attempt to entice a user into reviewing fraudulent documentation.
This rule detects potential email spoofing attempts where an email claims to originate from a specific domain ('gasparinutrition.com') or is intended for external recipients, but fails critical authentication checks. Specifically, it identifies emails with DMARC failure, SPF failure, and a suspicious DKIM signing domain associated with 'gappssmtp.com', indicating an attempt to bypass sender authentication mechanisms.
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
Detects users clicking links from emails containing Canadian payroll lures leading to fake Workday/ADP domains. The rule specifically looks for navigation to URLs matching a regex pattern for Workday, ADP, or payroll-related terms combined with login/auth/secure keywords, and correlates this with browser process events (Chrome or Edge).
Detects web traffic containing specific randomized CSS filter properties on top-level elements, frequently seen in Bluekit PhaaS toolkits. These properties are used to alter the visual hash of the rendered page, complicating automated screenshot or pixel-based analysis by security vendors. This technique is often combined with suspicious URL patterns indicative of credential harvesting sites.
Detects potential Browser-in-the-Middle (AiTM) credential relay attacks where a user clicks a malicious phishing URL, followed shortly by a successful interactive sign-in from a different IP address and a previously unseen device.
This rule detects potential lateral phishing attempts originating from a compromised Microsoft 365 account. It flags outbound internal emails containing payroll-related keywords, such as direct deposit or salary redirection, which are sent to HR or finance departments. This activity is correlated with recent mailbox rule modifications (like transport or inbox rules) by the same user, a technique often used by threat actors to hide communications or exfiltrate data, consistent with identified campaigns like Payroll Pirate.
Page 53 of 83