Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This query visualises the total amount of admin false positive submission by submission type.
This query helps reviewing status of submissions
This query visualises the top admins performing false positive submissions
This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found
Use this query to find emails with message IDs that resemble IDs used in known attack emails and contain a link a document in Google Docs. These behaviors have
been observed leading to ransomware attacks.
been observed leading to ransomware attacks.
In this detection, we track emails with personalized subjects.
In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign.
This query helps reviewing list of top 10 URL domains attacking the organization
This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days
This query helps hunting for emails from a sender with at least one email in quarantine
This query helps surface phishing campaigns associated with Appspot abuse.
This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page.
This query helps reviewing the list of top 10% of most attacked users
This query helps reviewing Phish detections done by some of the most frequent detection technologies in the last 7 days
This query helps reviewing malware detections by detection methods
One of the tricks used in phishing is obfuscating the domain name in a URL by
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
URLs clicked in Email
Detects strong indicators of a successful device code phishing attack. This rule correlates email events containing Microsoft device login URLs with subsequent Microsoft Entra ID authentication attempts that result in a specific error code (50199 or 0), indicating the user was prompted to confirm the application. The time window for correlation is set to 16 minutes, accounting for the typical 15-minute expiration of device codes.
Detects strong indicators of a successful device code phishing attack.
This analytic detects emails containing attachments with suspicious file extensions. It leverages the Email data model in Splunk, using the tstats command to identify emails where the attachment filename is not empty. This detection is significant for SOC analysts as it highlights potential phishing or malware delivery attempts, which are common vectors for data breaches and malware infections. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, system compromise, or data exfiltration. Immediate review and analysis of the identified emails and attachments are crucial to mitigate these risks.
The following analytic detects suspicious calendar invites sent via GSuite, potentially indicating compromised accounts or malicious internal activity. It leverages GSuite calendar logs, focusing on events where a high volume of invites (over 100) is sent within a 5-minute window. This behavior is significant as it may involve the distribution of malicious links or attachments, posing a security risk. If confirmed malicious, this activity could lead to widespread phishing attacks, unauthorized access, or malware distribution within the organization.
Page 82 of 83