Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,438
11,829
5,872
5,150
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; the suspicious-URL signal requires a high-confidence credential/urgency term (not generic business vocabulary); sender risk requires the domain to be new to both the recipient and the organization; and at least three independent signal categories (not two) must corroborate the language-confusion signal before the rule fires.
This rule detects potential AI prompt injection attacks delivered via email. It identifies users clicking external links directed at AI platforms (like OpenAI, Claude, or Perplexity) that contain suspicious URL parameters or instructions designed to manipulate or override the AI's standard behavior. It correlates the web request with a subsequent process execution on the host that includes suspicious keywords in the command line, suggesting an attempt to automate or exploit the AI assistant through local system interaction.
Detects potential callback phishing (Telephone-Oriented Attack Delivery) by correlating phishing-themed emails containing phone numbers with no hyperlinks to the subsequent execution or installation of common remote monitoring and management (RMM) software on the same host within a six-hour window. The rule further refines this by ensuring the RMM tool was not previously installed on the user's system.
Detects phishing emails that impersonate invoice-related correspondence, containing SharePoint links and a .url shortcut file attachment, a common technique for credential harvesting or malware delivery.
Detects two-stage phishing activity involving an initial visit to a Vercel-hosted lure page followed by the exfiltration or relay of fingerprinting and sandbox-evasion results to api.telegram.org.
Detects outbound HTTP traffic to punycode-encoded domains (typically used to spoof legitimate sites) that contain characteristic boilerplate text often generated by LLMs in their responses. This combination is indicative of an automated phishing kit setup or a landing page generated by an AI assistant.
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
A documented FileFix variant arrives as an HTML/MHTML email attachment styled to look like a Word document or PDF, displaying a fake 'file could not be rendered' prompt that leads into the address-bar paste.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects network navigation to Google Sites pages that match patterns associated with known Ledger-impersonating phishing campaigns. These sites are often reached through redirect chains involving Google Ads, cloud storage, and rotating domains.
Detects network navigation to Google Sites pages that match patterns associated with known Ledger-impersonating phishing campaigns. These sites are often reached through redirect chains involving Google Ads, cloud storage, and rotating domains.
Detects network navigation to Google Sites pages that match patterns associated with known Ledger-impersonating phishing campaigns. These sites are often reached through redirect chains involving Google Ads, cloud storage, and rotating domains.
Detects anomalous outbound email activity from an account that recently performed an OAuth device code sign-in characterized by elevated risk levels. The rule identifies potential token abuse by looking for a high volume of emails with either a significant percentage of external recipients or patterns indicative of bulk mailing, common in phishing campaigns that leverage compromised identities (e.g., EvilTokens).
Detects potential Business Email Compromise (BEC) by monitoring inbound email threads for unexpected changes in the sender domain during ongoing conversations. This rule flags replies that contain payment-related keywords (e.g., IBAN, SWIFT, bank details) where the sender domain has not been observed in the previous 30 days of the thread's history.
Detects instances where a user authenticates via the OAuth 2.0 device code flow followed shortly by a new device registration. The rule flags registrations where the device name shape is uncommon compared to historical data or where there is a mismatch between the IP address used for the authentication and the registration, indicating potential device code phishing or account takeover.
Detects known file hashes associated with SideCopy/ReverseRAT.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
Detects incoming email messages where the Reply-To header address domain differs from the Sender From address domain. This technique is commonly used in phishing attacks to redirect victim replies to an attacker-controlled mailbox while maintaining a spoofed appearance in the original sender field.
Detects inbound emails that have been delivered to the user's Inbox or Junk folder despite failing SPF authentication checks. The detection logic triggers when these emails also lack a valid DMARC policy (none or not available), which prevents the mail server from enforcing rejection or quarantine, allowing spoofed or unauthenticated mail to bypass standard security filters.
This rule detects potential phishing attempts where the sender's display name is formatted as an email address and the sender's domain uses a capital 'I' character to mimic a well-known service provider (typosquatting/homoglyph attack), such as 'gmaiI.com'. It identifies discrepancies between the actual sender domain and the normalized domain name after character replacement.
Page 9 of 83