Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
This rule detects potential spearphishing attempts targeting high-value individuals (CEO, CFO, IT Admin) within an organization. It looks for emails sent to these individuals with subjects commonly associated with financial phishing or social engineering lures, such as "Invoice," "Wire Transfer," "Payment," "Urgent," or "Purchase Order." The rule also checks if these emails contain attachments, which is a common vector for delivering malware or credential harvesting documents in phishing campaigns. It summarizes the attempts by sender, recipient, and day, counting the number of attempts and listing the attachments.
Microsoft Teams External Link Phishing
Cortex XDR
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing Top-Level Domains (TLDs). The rule specifically looks for messages in one-on-one chats containing external links with TLDs commonly associated with phishing, such as '.ru', '.dev', '.xyz', and others, which could indicate Phishing-as-a-Service (PhaaS) infrastructure or device code lure paths.
This rule detects emails with subjects related to financial transactions (Invoice, Purchase Order, PO, Payment, Order) that contain attachments with suspicious file extensions (.js, .hta, .vbs). It specifically filters for emails originating from domains not whitelisted as trusted and aggregates the count and average size of such attachments.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
This rule detects authentication attempts to Microsoft 365 Azure AD from a list of known malicious IP addresses and CIDR ranges associated with the EvilToken phishing campaign. It specifically filters for 'Cmsi:Cmsi' request types, which are indicative of session replay signals used in device code phishing.
Tycoon2FA PHaaS User Agent Detection
Cortex XDR
Detects user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) campaigns, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies user agents like 'axios/1.13.x' (credential relay variant) and 'node' or 'undici' (device code variant) in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
Identifies emails spoofing NIPR, NAIC, or Stripe domains with invoice-related lures that fail authentication. This rule specifically looks for emails where the sender's domain (SenderFromDomain or SenderMailFromDomain) is one of the targeted domains (nipr.com, naic.org, stripe.com), the subject contains keywords like 'invoice' or 'past due', and the email authentication details do not indicate a 'pass'. This combination suggests a phishing attempt leveraging brand impersonation and financial urgency.
This rule detects suspicious activity where a user clicks on a URL from an email and subsequently accesses a '.workers.dev' domain that contains keywords commonly associated with credential harvesting or malicious activity (e.g., 'docusign', 'onedrive', 'password_reset'). This pattern often indicates a phishing attempt where an attacker uses a Cloudflare Workers domain to host a malicious landing page.
I don't know how many time I suffered malicious actors sharing links via Microsoft services such as SharePoint or other sites manipulating them for phishing, malware, or other malicious purposes.
I have seen multiple detections to detect phishing campaigns based on subjects, such as detecting when an email subject ends with “with you” or contains “shared.” However, if the original mailbox is configured in another language, these rules become useless.
This change specifying the InternetMessageID value odspnotify and, in addition, specifying the first part of the InternetMessageId, which tells us the action requested or performed by the email—in this case, share.
For this detection, I recommend adding your trusted domains, but it is incredibly useful to detect when links from Microsoft systems are shared with your users from unexpected domains.
I have seen multiple detections to detect phishing campaigns based on subjects, such as detecting when an email subject ends with “with you” or contains “shared.” However, if the original mailbox is configured in another language, these rules become useless.
This change specifying the InternetMessageID value odspnotify and, in addition, specifying the first part of the InternetMessageId, which tells us the action requested or performed by the email—in this case, share.
For this detection, I recommend adding your trusted domains, but it is incredibly useful to detect when links from Microsoft systems are shared with your users from unexpected domains.
Detects potential SMS phishing (smishing) vectors involving a specific shortened URL used to deliver mobile surveillance and exfiltration malware, specifically the fake RedAlert application.
This rule detects a suspicious attack chain, potentially related to 'ClickFix' or similar social engineering campaigns. It correlates multiple events within a 5-minute window: a browser being launched from an email client, a file download from a browser into the Downloads directory, and a command prompt being launched from explorer.exe executing a command that references the Downloads directory. Additionally, it looks for network connections initiated by common document types, which could indicate malicious document activity.
Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder.
It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
Detects when Okta FastPass prevents a known phishing site.
Detects phishing emails abusing legitimate Trello invitation notifications. This rule specifically looks for emails sent from 'invitation-do-not-reply@trello.com' with a subject line matching the pattern '<name> @ <org> invited you to their board <board>'. This pattern is recently observed being abused in phishing campaigns to trick users into clicking malicious links embedded within Trello boards.
This rule detects potential social engineering attempts in external direct messages (DMs) by identifying messages that impersonate IT helpdesk or support personnel, or discuss 'working from home' scenarios. It specifically looks for keywords like 'helpdesk', 'help desk', 'IT support', and 'working from home' in the recipient details or sender display name of external messages within the last 5 days. The goal is to surface lures that aim to trick users into revealing sensitive information or performing actions under false pretenses.
This rule detects rare external domains shared in Microsoft Teams messages that users subsequently click on. It identifies messages from external senders, extracts URLs and their domains, and then filters for domains that appear infrequently (less than 3 times in the last day). The rule then correlates these rare external domains with user click events within Teams, surfacing potential phishing attempts or malicious link sharing where users interact with untrusted content.
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens device code phishing campaign. The rule specifically looks for a pattern like '[lure-type]-[3char-id].[username]-[domain]...workers.dev' to identify malicious URLs.
This rule identifies external domains sending a high number of unique links in Microsoft Teams messages over the last 7 days, excluding common trusted Microsoft domains. It aims to detect potential phishing attempts or unusual external communication patterns that might indicate malicious activity or data exfiltration.
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens phishing campaign lures. Attackers rely on this PaaS platform to host device code phishing pages and bypass domain reputation checks.
Page 64 of 83