Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects potentially malicious emails that leverage Calendly as a lure. It looks for emails that pass standard authentication (SPF/DKIM/DMARC) but contain suspicious elements such as URLs redirecting to Calendly or Google, subject lines related to common social engineering themes (complaints, health inspections, etc.), or the presence of ZIP attachments that match common photo/image naming patterns.
This rule detects suspicious emails exhibiting patterns associated with 'authentication laundering' by identifying the combination of legitimate scheduling or redirection links (e.g., Calendly, Google Redirect) with potentially malicious indicators such as zip file links, suspicious .cfd domains, or impersonation of booking management services. It calculates a laundering score based on these features and the health of email authentication signals (SPF/DKIM).
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies specific malicious attachment filenames, suspicious URLs, subject lines, and sender domains commonly used in these campaigns to deliver malicious content.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign using compromised legitimate domains to bypass email authentication controls.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects HTTP responses containing JavaScript files with a Content-Length exceeding 1MB. This behavior is associated with the Bluekit PhaaS (Phishing-as-a-Service) platform, which uses large, obfuscated JavaScript bundles for browser fingerprinting and to evade static security signatures.
Detects emails containing Microsoft Customer Voice URLs that redirect to known cloud-hosting platforms (vercel.app, amplifyapp.com, workers.dev) frequently used for phishing campaigns. This indicates an attempt to leverage legitimate Microsoft services to host or redirect to malicious content.
Identifies inbound emails leveraging the HR-themed "Code of Conduct" or "Employee Policy" subjects often used to trigger the AiTM campaign.
Detects phishing emails associated with the TONResolver RAT campaign that impersonate Booking.com partner support. The emails use Japanese-language lures concerning guest complaints, include 'invite.ics' calendar attachments, and contain URLs pointing to suspicious top-level domains (.cfd, .bond, .sbs, .shop) or specific 'photo-' URL patterns. The rule differentiates between malicious impersonation and legitimate booking.com domain traffic.
This rule monitors for suspicious emails involving the 'gasparinutrition.com' domain, specifically looking for indicators such as DMARC failures, spoofed display names (e.g., 'monitoring'), or attachments with file names related to business documents like distribution, settlement, or agreements. It also triggers on DNS queries for the same domain, which could indicate related outbound communications or C2 activity.
Detects instances where common PDF reader applications (Adobe Acrobat, Foxit Reader) spawn a web browser or command interpreter process with an HTTP/HTTPS URL in the command line. This behavior is highly indicative of a user interacting with a malicious link or call-to-action embedded within a PDF document, frequently associated with credential harvesting phishing campaigns.
Detects inbound emails from external domains that leverage generic automated sender display names (e.g., 'DocuSign', 'No-Reply') and deliver PDF attachments with lure filenames commonly associated with document-based phishing campaigns (e.g., 'Agreement', 'Settlement'). The rule specifically monitors for these indicators when the subject line also contains executive-level keywords, indicating a targeted phishing attempt against C-Suite personnel.
Detects inbound emails associated with the Latin-placeholder PDF phishing campaign. The detection triggers based on a high spam confidence level (SCL >= 5), a spam verdict, authentication failures (SPF softfail/fail and DMARC fail), and the presence of a PDF attachment.
This rule detects email spoofing attempts where the sender's display name is set to 'Monitoring', but the sender's email address does not contain 'monitoring', specifically targeting activity associated with the 'gasparinutrition.com' domain. This behavior is indicative of an impersonation attempt, commonly used in phishing campaigns to establish trust.
This rule monitors for incoming emails that pass DKIM authentication but fail DMARC verification, specifically where the signing domain is associated with Google Apps (gappssmtp.com). This pattern is often indicative of email spoofing, where an attacker sends mail from a legitimate provider's infrastructure but fails the domain alignment requirements of DMARC.
Detects incoming emails with specific subject lines or attachment names relating to 'distribution settlement agreement' or 'agreement settlement' that arrive as PDF attachments. The rule calculates a risk score based on sender domain reputation (known malicious), DMARC/DKIM authentication mismatches, and potential display name spoofing to identify phishing attempts.
Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. This rule specifically looks for instances where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' while the 'SenderMailFromDomain' (P1 envelope) is different, indicating an attempt to spoof the sender's domain.
Detects incoming emails that claim to be from a 'Monitoring' display name associated with the gasparinutrition.com domain or specific accounting sender address, which may indicate a spearphishing or impersonation attempt.
This rule identifies emails originating from or claiming to be from the domain 'gasparinutrition.com' or the specific address 'accounting2@gasparinutrition.com' while using the display name 'Monitoring'. This is a common pattern observed in phishing or social engineering campaigns where adversaries impersonate internal or trusted organizational functions.
Detects incoming email messages containing PDF attachments from 'gasparinutrition.com' that either have suspicious filenames indicating legal or contractual documents or contain external links redirecting to non-domain URLs. These indicators are consistent with credential harvesting or phishing campaigns.
Page 56 of 83