Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
The following analytic identifies potential phishing attempts blocked by Zscaler within a network. It leverages web proxy logs to detect actions tagged as HTML.Phish. The detection method involves analyzing critical data points such as user, threat name, URL, and hostname. This activity is significant for a SOC as it serves as an early warning system for phishing threats, enabling prompt investigation and mitigation. If confirmed malicious, this activity could indicate an attempt to deceive users into divulging sensitive information, potentially leading to data breaches or credential theft.
This rule detects potential SVG-based phishing attempts originating from Microsoft Outlook. It correlates network access, file downloads, and URL click telemetry to identify instances where Outlook initiates connections to or downloads files ending with '.svg'. This is particularly relevant for detecting phishing campaigns that leverage malicious SVG files to embed JavaScript, redirectors, or Base64-encoded HTML payloads for credential harvesting or other malicious activities.
This KQL is focus on gather statistics related to hackers activities over our tenants, such as the number of emails sent tagged as threats. Below, I’ve provided KQL queries to help identify the risky ASNs mentioned at the beggining.
You can adjust the filtering criteria by modifying the line: “| where SuspiciousPercentage > 95 and Total_different_IPs > 10” based on your specific requirements.
You can adjust the filtering criteria by modifying the line: “| where SuspiciousPercentage > 95 and Total_different_IPs > 10” based on your specific requirements.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects HTML phishing pages created by the 'IUAM ClickFix Generator'. These pages mimic browser verification challenges to trick users into executing malicious PowerShell or Bash commands to deliver infostealers like DeerStealer and Odyssey.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
This query detects URLs shared in Microsoft Teams messages, chats, or meetings that may represent potential security risks. It filters out internal domains, SharePoint URLs, placeholder links, and known system domains to focus specifically on unique external URLs being exchanged within the organization.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
Detects potential malicious email execution chains where Microsoft Outlook spawns suspicious child processes (e.g., powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
This rule detects phishing attempts by identifying emails containing URLs and endpoint network connections to domains known to be associated with phishing campaigns. It leverages an external Indicator of Compromise (IOC) list of phishing domains. The rule scans email events for inbound messages with URLs matching these domains and also monitors endpoint network events for successful connections or HTTP inspections to these malicious domains. The results from both email and endpoint sources are then combined to provide a correlated view of potential phishing activity.
This rule detects potential malware infections and command and control activity by correlating email, endpoint file, and network events with indicators of compromise (IOCs) sourced from an external OSINT feed. It specifically looks for SHA256 hashes in email attachments, domains and URLs in email links, MD5, SHA1, and SHA256 hashes of created files on endpoints, and IP addresses and domains in network connections (both direct and HTTP inspected connections). The rule aims to identify initial access, execution, and command and control phases of an attack, potentially involving Cloudflare Tunnels as suggested by the rule's title and the OSINT source.
here we go with another quick and dirty one to detect Phishing Urls in Emails listed on phishunt.io Feed.
Recommended Action move to Junk Mail Folder or Delete the Message
Recommended Action move to Junk Mail Folder or Delete the Message
This rule detects network connections to known EvilGinx phishing infrastructure, identified by specific remote URLs, IP addresses, and a suspicious login URL pattern. EvilGinx is a phishing framework used for credential harvesting and session cookie theft, often employing adversary-in-the-middle techniques.
This rule detects and correlates Microsoft Defender's Zero-hour Auto Purge (ZAP) actions on emails. It joins original email delivery events with subsequent ZAP actions (Malware ZAP or Phish ZAP) to calculate the dwell time between an email's delivery and its removal. This helps in understanding how long a malicious or phishing email was present in a user's inbox before being remediated, which is crucial for incident response and assessing potential user interaction with the threat.
This rule detects emails containing URLs that match domains identified as phishing domains by cert.pl. It joins email URL information with a regularly updated list of known malicious domains from cert.pl and then correlates these with email events to identify potential phishing attempts.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity, commonly associated with frameworks like Evilginx. The rule identifies suspicious domain patterns where legitimate identity provider (IdP) domains are used as subdomains of another domain, or where IdP-related keywords are used in hyphenated subdomains.
This KQL query is designed to enrich "Malicious URL Click" alerts by correlating them with user sign-in activity. It finds the affected accounts and then checks if they had a successful login from a new IP address around the time of the alert. The final output flags high-risk events where a user's URL click activity is immediately followed or preceded by a login from an IP they've never used before. This helps prioritize investigation into potentially compromised accounts.
Detects successful non-interactive sign-ins to Microsoft Graph using the Visual Studio Code (VSCode) application identity. This behavior was observed in a phishing campaign where threat actors tricked users into an OAuth flow to harvest tokens. These tokens were then used to access user data, such as emails, via the Graph API.
Detects incoming emails that contain suspicious attachment types (e.g., RAR, ZIP) or links to file-sharing services, combined with subject lines commonly used in phishing campaigns. This pattern is indicative of initial access attempts via spear-phishing.
Page 70 of 83