Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects emails delivered to user inboxes that contain both a PDF attachment and a URL identified as a phishing link. This rule is designed to identify modern QR code phishing (quishing) campaigns where the malicious URL is embedded within the PDF to bypass traditional email security scanning. The detection relies on the email security solution's ability to extract and flag URLs from attachments, including those embedded in QR codes.
This rule detects inbound emails containing URLs that are commonly used for OAuth consent phishing, where an attacker attempts to trick users into granting permissions to a malicious application.
Detects when the Palo Alto Networks firewall does not block traffic to a URL known to be used in phishing attacks. An adversary can abuse this by directing victims to the phishing site, potentially stealing credentials, deploying malware, or conducting other malicious activities.
No description available.
This rule detects potential spearphishing attempts where the sender's email address is from Gmail, there are no attachments or URLs, and the subject line of the email matches the recipient's first name. This pattern is often used in highly targeted social engineering attacks to appear legitimate and bypass traditional email security controls.
This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6).
This rule detects emails containing a URL to a suspicious domain. It also checks if any of these suspicious URLs were subsequently clicked by a user, indicating potential compromise or successful phishing.
This rule detects phishing attempts that leverage Google redirect links. It identifies emails where the URL contains 'google.' and '/url?' and the URL domain is 'google', but the extracted domain is not 'com'. This indicates a potential malicious redirect through Google's services, often used to obscure the final malicious destination. The rule then joins this URL information with email event data to provide context such as sender, recipient, subject, and delivery location, focusing on emails delivered to the Inbox or Junk folder but not quarantined.
This rule detects attempts to phish user credentials by identifying Base64 encoded User Principal Names (UPNs) or their domains within URLs clicked by users. Adversaries often encode sensitive information like UPNs in malicious URLs to bypass security controls or to make the links appear less suspicious. The rule specifically looks for partial Base64 encoded strings of the user's UPN or domain within the 'UrlChain' field of URL click events.
This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught.
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query
Detection of spear-phishing emails containing a signed Remote Desktop Protocol (RDP) configuration file designed to connect to an actor-controlled server. In some cases, the threat actor attempted to enhance credibility by impersonating Microsoft employees and referencing other cloud providers in the phishing lures.dp files in Outlook temporary folders
KQL Query
This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location.
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
KQL Query from file: Detecting External Microsoft Teams Spray
This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location.
This query visualises total inbound emails with Spam detections.
This query visualises top 15 users targeted with Spam with summarized spam detections.
KQL Query from file: The Hunt for QR Phisher
Page 72 of 83