Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects phishing emails where the sender domain (gasparinutrition.com) is spoofed or compromised. The emails are routed through Google Workspace infrastructure (gappssmtp.com) which results in a DMARC alignment failure under strict policies (adkim=s; aspf=s). The rule specifically flags emails containing PDF attachments with subject lines related to distribution, settlement, or agreements.
Detects the execution of files attempting to spoof benign document types via double extensions, specifically when initiated by explorer.exe. This technique is often used in phishing attacks to trick users into executing malicious files that appear to be safe documents.
Detects the execution of financial-themed executable files (masquerading as .com or .scr) that are launched directly from common email client processes. This rule aims to identify phishing attempts where users are tricked into opening malicious attachments disguised with financial keywords.
Detects first-time external sender domains delivering multiple voicemail-themed or financial urgency emails to the same recipient during off-hours (midnight-06:00 UTC), consistent with Scotiabank TOAD callback phishing targeting CFO/finance executives.
This rule detects network connections to a list of domains identified as associated with phishing activities associated with Crimson Kingsnake. Monitoring these connections can help identify compromised systems or users attempting to access malicious sites.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Identifies emails with low text content but containing image attachments (.png/.jpg) associated with QR code "Quishing" attacks, a rising Q1 trend. The rule specifically looks for image attachments with filenames containing keywords like 'scan', 'qr', 'barcode', 'auth', or 'mfa', and joins this with email events that have no URLs, indicating the QR code is the primary call to action.
Detects application consent by a user shortly after the same account clicked a code-of-conduct or compliance-themed message. This behavior can indicate a multi-stage phishing campaign where a user is lured into clicking a malicious link (e.g., a fake policy document) and subsequently grants OAuth permissions to a malicious application.
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
This rule detects potentially unauthorized or suspicious Google Forms collaboration invitations delivered via email. It filters for emails that pass full sender authentication (SPF, DKIM, and DMARC) and originate from Google infrastructure, while containing a specific Google Forms editor invite URL pattern. The rule excludes internal organizational communications from the Google domain and identifies specific return-path domains commonly associated with automated Google Forms sharing notifications to highlight external or unexpected collaboration requests.
Detects phishing emails that impersonate Scotiabank using the 'From' display name, while originating from a non-scotiabank.com domain. The rule identifies emails that bypass SPF and DMARC checks and originate from GoDaddy-hosted email services, as indicated by the 'X-SECURESERVER-ACCT' header, suggesting the use of a compromised small-business account.
Detects incoming emails originating from Google infrastructure (Gmail or Google Forms) where the sender's display name closely matches the recipient's local username part. This heuristic is commonly used to identify targeted spearphishing campaigns where attackers impersonate internal users or trusted entities via abuse of legitimate Google services.
This rule detects potentially malicious email messages masquerading as Google Forms collaboration invitations. It identifies emails originating from Google-related domains that contain URLs for Google Forms with invite parameters. The detection logic filters for messages passing SPF, DKIM, and DMARC authentication checks to highlight legitimate-looking emails that may be part of a social engineering campaign, and flags instances where the sender's display name matches the recipient's name as a high-risk indicator of impersonation.
Detects instances where an email client (Outlook, Thunderbird, Edge, Chrome, Firefox) spawns `cmd.exe` with highly obfuscated command-line arguments. This behavior is characteristic of phishing delivery chains, specifically mentioning Phantom Stealer, which often uses Base64, XOR, and Donut for obfuscation. The rule looks for specific keywords and patterns indicative of obfuscated commands, such as `-enc`, `-EncodedCommand`, `FromBase64String`, `certutil`, `^^`, `!x!`, and `set /p`.
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign leveraging compromised legitimate domains to bypass email authentication controls.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Identifies instances where a browser process is spawned directly with a Base64-encoded data: URI in its command line. This technique is used to load malicious HTML content without touching the disk or network, often associated with phishing attempts.
Detects web traffic where a user initiates a request for content related to 'policy', 'conduct', 'compliance', or 'handbook', experiences at least three redirects across different hosts, and ultimately lands on a page containing keywords indicative of a login, sign-in, OAuth, or authorization prompt. This pattern is often used in multi-stage phishing campaigns to obscure the malicious infrastructure.
Page 57 of 83