Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This rule monitors email traffic for communication involving identified malicious domains and sender addresses. It cross-references sender information in the EmailEvents log with a predefined set of suspicious domains and email addresses, highlighting potential phishing or malicious outreach attempts.
This rule detects activity associated with known indicators of compromise (IOCs) related to European political targeting campaigns. It monitors network, email, and authentication logs for connections to specific malicious domains (including .onion addresses) and IP addresses. The rule spans multiple data sources, including device network events, Entra ID sign-in logs, cloud application events, and email communications.
Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.
Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
Detects inbound emails masquerading as reputable advisory firms (PwC or KPMG) using lookalike sender domains, combined with wire-transfer fraud phrases in the subject line. Correlates with identity logon telemetry for the same fraudulent WhatsApp Business phone number, enabling detection across both email and authentication channels. Note: message body content is not available in the EmailEvents schema, so fraud-phrase matching is subject-only.
This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.
This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects incoming emails that impersonate DocuSign notifications, specifically looking for typical phishing lures involving 'Remittance Advice' and a call-to-action to 'Tap here to view document'. This rule identifies emails using common social engineering tactics to harvest credentials or distribute malware via fake document links.
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
Detects anomalous, high-volume access to email items or attachments in Microsoft Exchange Online by a single account from a single IP address, which may indicate account compromise, unauthorized mail harvesting, or data exfiltration.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
This rule detects a correlation between an email phishing burst (high volume of emails with a specific failed payment subject) and the subsequent creation of suspicious 'x_trace_' files in 'var/report/' directories. This pattern is indicative of a phishing campaign where a malicious attachment or link might be attempting to write local tracking or diagnostic files on a victim's host.
This rule detects a correlation between an email phishing burst (high volume of emails with a specific failed payment subject) and the subsequent creation of suspicious 'x_trace_' files in 'var/report/' directories. This pattern is indicative of a phishing campaign where a malicious attachment or link might be attempting to write local tracking or diagnostic files on a victim's host.
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
Detects anomalous email access patterns across multiple mailboxes using specific application identifiers or access contexts often associated with automated collection tools. This rule flags when an application accesses more than 20 items across distinct mailboxes in a 15-minute window, which is indicative of potential unauthorized bulk email collection or data exfiltration.
Detects anomalous email access patterns across multiple mailboxes using specific application identifiers or access contexts often associated with automated collection tools. This rule flags when an application accesses more than 20 items across distinct mailboxes in a 15-minute window, which is indicative of potential unauthorized bulk email collection or data exfiltration.
Page 18 of 40