Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This rule detects emails originating from Atlassian Jira (specifically the .atlassian.net domain) that contain subject lines associated with a known spam campaign. The campaign uses various lures, including investment scams and online casinos, across multiple languages.
This rule detects network connections to domains identified as malicious redirectors or landing pages used in a spam campaign that exploited Atlassian Jira. The domains are associated with phishing or malware distribution efforts.
Detects incoming emails from Atlassian Jira Cloud subdomains where the subject line matches known spam patterns used in a campaign abusing the service's reputation.
Domains that introduce substitutions, extra characters, or randomness (e.g., micr0soft, paypa1-secure) tend to have higher entropy than the original brand name. This increase in entropy is a useful signal for detecting typosquatting and brand impersonation attempts in phishing campaigns.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
Detects DNS queries for subdomains that match a specific pattern used by the threat actor GS7. The actor uses a semi-automated infrastructure with highly specific subdomain naming conventions, such as 'rss.[random]-auth.com' or 'cpcalendars.[random]-verify.online', to host phishing pages and payloads.
https://www.kaseya.com/blog/dkim-replay-attacks-apple-paypal-invoice-abuse/
This rule detects emails delivered to an inbox that contain URLs identified as malicious by OpenPhish, indicating a successful phishing attempt or delivery of a known malicious link.
This is a KQL script to automate investigation by full email address. This can be pitched as a workbook as well. Keep in mind all the extra stuff is there for automation, this doesn't need to be your day-to-day query. There's simpler stuff you can make it on the fly in a matter of seconds and give you similar results. This here is for extra information in case you need a single pane of glass.
This rule detects instances where users click on URLs from emails that impersonate 'DocMagic'. It specifically looks for emails with 'docmagic' in the sender display name or address, extracts URLs from these emails, and then identifies if any of these URLs were subsequently clicked by users. This indicates a potential successful phishing attempt related to the DocMagic impersonation campaign.
This rule detects potential phishing activity by identifying inbound emails from specific sender addresses that were not blocked by Microsoft Defender for Office (MDO), followed by network connections to a known malicious infrastructure associated with 'Tycoon2FA'. The rule first looks for unblocked emails from 'donotreply@docmagic.com' and 'noreply@frigoarrobba.com.br'. If such emails are found, it then checks for network connections to 'listener.facraivo.sa.com' within a 7-day window, indicating a potential compromise or user interaction with the phishing attempt.
Of course you can get an easier version to simply search emails by subject, this is too verbose. But this is used to make a workbook that will display a set of information about the incident and give you the possibility to click on a button, generate this and visit the incident's page.
Detects a browser visiting a URL with phishing-related keywords, followed by a direct network connection to a known Large Language Model (LLM) API endpoint from the same device within a short time window. This correlated behavior is a strong indicator of the "runtime assembly" attack pattern, where a malicious page dynamically generates a phishing payload by calling an LLM service.
ET PHISHING Microsoft ClickFix Landing Domain
ET PHISHING Microsoft ClickFix Landing Domain
Detects TruffleHog credential validation via sts:GetCallerIdentity - initial access indicator for AWS WorkMail phishing campaigns
This query hunts for inbound emails that contain URLs embedded in QR codes and originate from senders that are not commonly observed in the environment, a common technique used in QR-based phishing campaigns.
This query hunts for network activity and other events related to specific domains (freefoodaid.com, wellnessmedcare.org) potentially associated with CVE-2026-21509. It searches DNS queries, network connections, generic web proxy/firewall logs, and URL click events to identify interactions with these domains.
This query is better used in a workbook for automation.
Detects emails containing threat-actor lure links to trojanized ScreenConnect MSI files, specifically targeting 'cld.pt' downloads with 'COMPROBANTE*.msi' patterns. The rule also looks for 'COMPROBANTE' keywords in email subjects as a fallback.
This rule detects a multi-stage attack chain starting with a high-confidence phishing email, followed by a risky sign-in from the recipient, and culminating in sensitive actions within Azure, specifically targeting IAM role assignments, storage account key access, or AKS cluster modifications. The detection correlates these events within a defined time window to identify potential compromise of cloud resources originating from a successful phishing attack.
Page 67 of 83