Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This rule detects potentially malicious activity where an attacker, having performed a password reset or MFA change on a compromised account, attempts to hide their tracks by rapidly deleting security-related notification emails (e.g., password reset alerts) shortly after they arrive in the user's mailbox. It correlates Exchange mailbox operations with audit log account security changes to filter out routine noise.
Detects a sudden spike in subscription/confirmation-themed emails to a single recipient within a 10-minute window, significantly exceeding that recipient's historical baseline, excluding properly authenticated reputable bulk senders. This pattern is consistent with 'email bombing' used by UNC6692 to overwhelm targets before follow-up vishing/Teams-based IT impersonation social engineering.
Detects a potential account takeover scenario where a user receives a password reset notification email followed within 10 minutes by a non-SSO application password change from the same IP address. This sequence is characteristic of Adversary-in-the-Middle (AiTM) phishing or vishing campaigns where an attacker intercepts session tokens or uses social engineering to force a password reset and immediately secures the account for persistent access.
Detects the creation of a new inbox rule that performs email manipulation actions (forward, redirect, delete, move, or stop processing) shortly after a user account has logged in with a high or medium risk score, or an unusual result type. This pattern is commonly indicative of account compromise where an attacker establishes persistence or data exfiltration via mailbox rules.
This rule detects the creation of email monitors or mail routing destinations within Google Workspace. These actions are indicative of persistent access methods where an attacker redirects or copies sensitive emails to an external or attacker-controlled account, enabling long-term intelligence gathering.
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
Detects inbound emails originating from a gmail.com sender that have not previously communicated with the recipient in the last 90 days. The rule identifies emails containing e-card or greeting card-themed subjects, which are often used as social engineering lures to masquerade as automated branded notifications for malicious activity or credential theft.
Detects inbound emails masquerading as ServiceNow ticket notifications that solicit sensitive information (e.g., vendor IDs, invoice numbers, bank account details) via reply-only body content. This technique evades traditional SEG scanning by avoiding malicious URLs or attachments and leveraging the reputation of legitimate, though spoofed, ServiceNow infrastructure.
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
Detects potential business email compromise or phishing attempts by identifying inbound emails that pass authentication checks but involve a first-time sender-recipient pair (no correspondence in 90 days) referencing financial themes such as invoices, bank accounts, or purchase orders.
This rule detects potential phishing emails that successfully pass through to the mailbox despite failing SPF, DKIM, or DMARC authentication checks. It specifically flags emails that claim to originate from high-value vendor domains (e.g., DocuSign, Zoom, Adobe, RingCentral) but contain links to external domains that do not match the alleged sender's domain, which is a common indicator of brand impersonation or credential harvesting campaigns.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
This rule detects potential phishing emails that successfully pass through to the mailbox despite failing SPF, DKIM, or DMARC authentication checks. It specifically flags emails that claim to originate from high-value vendor domains (e.g., DocuSign, Zoom, Adobe, RingCentral) but contain links to external domains that do not match the alleged sender's domain, which is a common indicator of brand impersonation or credential harvesting campaigns.
During my vacation, I've been enjoying conversations with people from different countries about their national teams and the World Cup. What I don't expect (although it certainly can happen) is a Mexican speaking Japanese, a Spaniard speaking Russian, or an Egyptian speaking Spanish. Yet, this is becoming more and more common, and I love it. Our world is becoming increasingly connected and multicultural.
However, the same logic doesn't always apply to emails.
That thought inspired me to build a KQL query that I'll explore further after my break, but I wanted to share it now. The idea is detect emails where the language doesn't match the expected language(s) of the sender's country. While this isn't a detection by itself, it can be a valuable hunting signal when combined with other indicators.
KQL Query Filter options:
EmailCount < X → Filter based on the number of emails observed.
Country !in ("Spain") → Exclude countries with a higher false-positive ratio.
SenderDomains !in ("Domain1","Domain2") → Exclude trusted sender domains.
However, the same logic doesn't always apply to emails.
That thought inspired me to build a KQL query that I'll explore further after my break, but I wanted to share it now. The idea is detect emails where the language doesn't match the expected language(s) of the sender's country. While this isn't a detection by itself, it can be a valuable hunting signal when combined with other indicators.
KQL Query Filter options:
EmailCount < X → Filter based on the number of emails observed.
Country !in ("Spain") → Exclude countries with a higher false-positive ratio.
SenderDomains !in ("Domain1","Domain2") → Exclude trusted sender domains.
This rule detects incoming emails with subject lines containing keywords associated with invoice, payment, or banking detail changes. These patterns are highly characteristic of Business Email Compromise (BEC) and social engineering campaigns designed to redirect financial transactions to fraudulent accounts.
This rule monitors email traffic by aggregating data from email events, attachment information, and URL click interactions. It identifies emails that contain attachments and correlates them with specific file attributes (name, extension, hash, threat type) and any subsequent user interaction with URLs contained within those emails, including blocked or allowed clicks.
This rule identifies suspicious email messages that contain isolated blocks of text preceded by at least two whitespace characters (including newlines, carriage returns, or tabs). This pattern is often used by threat actors to obfuscate content, attempt to bypass email gateway filters, or hide malicious strings from security scanners by breaking up content flow.
Detects incoming email messages containing common prompt injection strings aimed at manipulating Large Language Models (LLMs). The rule scans email bodies for directives such as 'ignore previous instructions', 'save this to your memory', or other obfuscation patterns frequently used in adversarial prompting to bypass LLM safety guardrails or perform unauthorized data extraction.
Page 23 of 40