Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,736 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,736
Platforms
1,163
329
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens phishing campaign lures. Attackers rely on this PaaS platform to host device code phishing pages and bypass domain reputation checks.
This rule detects messages within Microsoft Teams that have been identified by Microsoft Defender for Office 365 as containing phishing attempts, malware, or spam. It specifically looks for messages with 'Phish', 'Malware', or 'Spam' verdicts in the ThreatTypes field, allowing for quick identification and triage of malicious content.
This rule analyzes URL click events within Microsoft Teams to identify and summarize actions taken on URLs, specifically focusing on Safe Links outcomes. It helps in understanding user interaction with links, potentially identifying malicious link clicks that Safe Links has intercepted or allowed, and assessing the adoption of Safe Links protection within the Teams environment.
This rule identifies instances where users have clicked on URLs within Microsoft Teams. It specifically filters for 'UrlClickEvents' where the 'Workload' is 'Teams' and provides details such as the timestamp, user principal name, URL, URL domain, action type, and network message ID. This can be used to investigate potential phishing attempts or malicious link clicks within the Teams environment.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
This rule detects instances where a user clicks on a URL in an email, and the final redirected URL is hosted on 'workers.dev', which is often abused for phishing campaigns, particularly OAuth device code phishing. It correlates email delivery events with URL click events and analyzes the full redirect chain to identify the final destination.
This rule detects inbound emails with an SVG attachment that is disguised as an HTML file and contains a long, base64-like string in its filename. This pattern is often used in phishing campaigns to bypass traditional email filters and deliver malicious content, potentially leading to credential harvesting or malware delivery. The rule specifically looks for files with a '.svg' extension but a 'html' file type, combined with a filename containing a string of at least 20 alphanumeric characters, plus or minus, equal signs, which is characteristic of base64 encoding.
This rule detects emails containing a specific URL (https://openclaw.ai/install.ps1) which is known to host a PowerShell script. This indicates a potential attempt to deliver malicious code via email, likely as part of a phishing campaign to execute the script on the recipient's system.
This detection identifies instances where a user has clicked on a URL within an email and has actively bypassed a security warning page. This behavior is a strong indicator of a successful phishing lure or high-risk user action, as the user has ignored a direct warning about the potential danger of the destination link.
This rule detects network connections or email URLs that contain domains associated with the 'ShinyHunters' threat group's infrastructure. The rule specifically looks for a predefined list of domains known to be used by ShinyHunters for phishing or other malicious activities. It correlates email URL information with device network events to identify potential compromise attempts.
Attackers take advantage of the emojis because they help the content stand out and gets more attention than plain text. It not apply just to Email Subject if not that it also applies to Attachment Files which based on my experience, legitime file not use to have icons in their file names.For example:
📄Invoice.pdf
🔐Reset_Password.html
📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on emails
- Files downloaded from phishing emails
- User-downloaded /opening scam files
- Payloads with social engineering names
📄Invoice.pdf
🔐Reset_Password.html
📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on emails
- Files downloaded from phishing emails
- User-downloaded /opening scam files
- Payloads with social engineering names
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Detects incoming emails where a single URL contains indicators of two or more distinct security vendor rewriting services. This technique is used by adversaries to create multi-layered redirect chains to bypass automated scanners and deliver malicious content, as seen in Tycoon2FA and Sneaky2FA campaigns.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
This rule detects network connections to a list of domains identified as associated with phishing activities associated with Crimson Kingsnake. Monitoring these connections can help identify compromised systems or users attempting to access malicious sites.
Marketing emails use Emojis all the time… but attackers use them too because they catch attention and increase the chance someone clicks:
- ⚠️ Urgent messages
- 📦 Delivery notifications
- 📄 Fake invoices
- 🔐 Password resets
Identify and classify cases on Email Subjects can be converted in useful detections. It query identify:
- Emails received with icons in the subject
- Where the URL was clicked
- Excluding cases where the sender is added as allowed either in the organization or user level
- Summarise by number of Emails, number of distinct recipients and also identify if the messages were delivered into Inbox Folders
- ⚠️ Urgent messages
- 📦 Delivery notifications
- 📄 Fake invoices
- 🔐 Password resets
Identify and classify cases on Email Subjects can be converted in useful detections. It query identify:
- Emails received with icons in the subject
- Where the URL was clicked
- Excluding cases where the sender is added as allowed either in the organization or user level
- Summarise by number of Emails, number of distinct recipients and also identify if the messages were delivered into Inbox Folders
This rule correlates an email URL click with a subsequent risky sign-in from the same user within a short timeframe (1 hour). This is a strong indicator of a successful Adversary-in-the-Middle (AiTM) phishing attack, such as those conducted with the Tycoon2FA kit, where a user is tricked into authenticating through a malicious site, allowing the attacker to capture their session.
Correlates an email URL click with a subsequent risky sign-in from the same user within a short timeframe. This pattern is a strong indicator of a successful Adversary-in-the-Middle (AiTM) phishing attack, such as those conducted with the Tycoon2FA kit, where a user is tricked into authenticating through a malicious site, allowing the attacker to capture their session.
KQL Query from file: OauthMSPhish Detection
This rule detects potential phishing attempts targeting Docusign users. It identifies emails containing URLs or network connections to specific domains (page-docusign-[a-z0-9]+\.workers\.dev) which are commonly used in phishing campaigns to mimic legitimate Docusign login pages or related services. The use of 'workers.dev' subdomains often indicates malicious infrastructure.
Page 65 of 83