Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
Detects an inbound email flood attack (many distinct senders to a single recipient within a 5-minute window) followed by an external Microsoft Teams message sent to the same user, typically associated with IT support pretexting or callback phishing attacks.
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Detects a mail bombing pattern where a recipient receives a burst of inbound emails from many distinct senders within a short time window, followed by a Microsoft Teams message or chat creation from the same user context shortly after.
Detects a potential multi-stage social engineering attack where a user first receives a high volume of emails (mail-bomb burst) within a short window, followed shortly by an external Microsoft Teams message from a suspicious throwaway tenant using an IT help desk display name.
Detects inbound emails where the sender claims to be from an internal or organization domain but has a null envelope sender address, lacks valid DKIM authentication, and does not match common legitimate automated messages (like DSNs or auto-replies), potentially indicating email spoofing or phishing attempts.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Detects inbound emails impersonating OpenCode breach notices that urge API key rotation and contain links to non-OpenCode domains.
Detects a potential social engineering or phishing attack pattern where a recipient first receives a high volume of inbound emails (mail flood) within a short window, followed quickly by an external Microsoft Teams chat message from an IT-themed sender attempting to impersonate internal support.
Detects delivered emails where the subject line matches a specific pattern (five digits followed by a hyphen and text) and the attachment filename corresponds to the extracted subject text, ending with 'Document.xlsx', and the email was not quarantined post-delivery.
Detects inbound mail carrying an attachment from a sending server not previously
seen. Most legitimate correspondence arrives from infrastructure with history;
first-contact plus attachment is the shape of a targeted delivery attempt.
Pair with the recipient list: a single first-seen sender reaching many recipients at
once is a campaign rather than a one-off.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_RECEIVED' and file != ''
| groupby remoteip, sender, file, recipient
seen. Most legitimate correspondence arrives from infrastructure with history;
first-contact plus attachment is the shape of a targeted delivery attempt.
Pair with the recipient list: a single first-seen sender reaching many recipients at
once is a campaign rather than a one-off.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_RECEIVED' and file != ''
| groupby remoteip, sender, file, recipient
M365 Malicious Mailbox Rule Abuse
Cortex XDR
Detects the creation or modification of Microsoft 365 Exchange inbox rules that exhibit characteristics of malicious behavior, such as using trivial or blank names, moving items to rarely-monitored folders (e.g., 'Conversation History', 'RSS Feeds'), or containing keywords related to phishing, credential harvesting, or financial fraud.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects a message having its recipient altered during processing. Recipient
rewriting redirects mail away from its intended reader, and is a quiet way to
intercept correspondence or to suppress a notification that would otherwise reveal
an ongoing compromise.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TREND-MICRO-DDEI'
and action='EMAIL_RECIPIENT_CHANGED'
| groupby sender, recipient, direction, remoteip
rewriting redirects mail away from its intended reader, and is a quiet way to
intercept correspondence or to suppress a notification that would otherwise reveal
an ongoing compromise.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TREND-MICRO-DDEI'
and action='EMAIL_RECIPIENT_CHANGED'
| groupby sender, recipient, direction, remoteip
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Detects incoming emails containing QR code references in the body along with registration/invitation subjects and common document or image attachments, where the QR code URL is either missing (undecoded) or points to domains other than Google Forms, potentially indicating a phishing attempt attempting to bypass standard URL inspection.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Page 1 of 40