Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This rule detects two suspicious activities within a user's mailbox: (1) An email flood, where a recipient receives more than 500 emails within a 5-minute window, potentially indicating an attempt to overwhelm or hide secondary emails; and (2) The creation or modification of inbox rules that include actions like deleting or moving messages, which is a common persistence and evasion technique used by attackers to hide C2 or phishing communications.
This rule detects anomalous or risky sign-in events for user accounts that have recently configured an active out-of-office (OOF) auto-reply. An attacker may leverage a user's known absence to gain access to their email or other corporate resources using compromised credentials, as the user is less likely to notice suspicious account activity while away.
Detects incoming phishing emails that impersonate healthcare-related organizations. The detection identifies malicious activity by matching common healthcare-themed domain patterns in the From header, coupled with email authentication failures (DMARC or DKIM), and a mismatch between the envelope sender and the header From address. It also monitors for invoice-themed subject line lures commonly used in social engineering.
This rule detects invoice-themed phishing emails that impersonate healthcare organizations. It identifies suspicious messages by analyzing email authentication failures (DKIM/DMARC/SPF) and specific delivery conditions like 'compauth=none' or 'reason=451', which are often indicative of phishing campaigns leveraging open redirect services for obfuscation.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects a sequence of events indicative of a successful phishing attack: a user receives an email containing a suspected phishing URL, clicks the URL, and subsequently performs a successful sign-in from an IP address not seen in their recent 14-day history within 15 minutes of the click.
This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.
Detects inbound emails containing attachments with file extensions commonly used for HTML/SVG smuggling (.html, .htm, .svg, .shtml, .xhtml). This technique is often used to bypass email security filters by assembling malicious payloads client-side after the email has been delivered. The rule specifically looks for inbound emails where the attachment has not been blocked or junked by the email gateway.
This rule detects potential phishing attempts where users receive SharePoint sharing invitations or links from external tenants that are not part of the organization's trusted SharePoint environment. It identifies inbound emails from SharePoint notification senders containing URLs to external SharePoint tenants and also flags internal SharePoint sharing events (invitations or anonymous link creations) initiated by accounts whose domain differs from the home tenant. This could indicate an attacker attempting to lure users to malicious external SharePoint sites or using compromised accounts to facilitate external sharing.
Tracks the Kali365 tool iterating through the victim's inbox, performing mass mail item reads or API-driven exports of mailbox contents.
Inbox Rule Notification Suppression
Cortex XDR
Detects the creation or modification of inbox rules designed to hide security and MFA notifications by deleting, marking as read, or moving them to hidden folders. This technique is commonly used post-compromise to suppress alerts about rogue device enrollment, sign-ins, or password changes, preventing the victim from discovering an account takeover. It is a frequent persistence technique in Business Email Compromise (BEC) and Account Takeover (ATO) attacks.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Detects inbound emails that fail SPF, DKIM, or DMARC authentication checks while containing keywords related to invoices or payments in the subject line, and referencing known potentially malicious SaaS URLs (holabrief.com or loopedin.io) in the body or URL fields.
This rule monitors for two distinct suspicious activities: 1) Inbound emails where the sender display name matches a list of executive titles, commonly indicative of Business Email Compromise (BEC) or executive impersonation attacks; 2) The creation of cloud service accounts with names mimicking administrative or IT support roles, which may indicate an adversary establishing persistent, privileged access.
This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.
Detects inbound emails from 'gmail.com' where the sender's display name closely matches the recipient's local username part. This pattern is commonly used in business email compromise (BEC) and phishing attacks to impersonate colleagues or known contacts.
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies emails containing malicious PDF attachments (e.g., 2026-0610-1.pdf) or directing users to the known phishing domain 'govtop.one', commonly used to harvest credentials or deliver malware.
This rule monitors email metadata for patterns associated with known phishing campaigns mimicking Booking.com. It looks for specific lures in email subjects, suspicious attachment filenames such as 'invite.ics', malicious domains using the .cfd TLD, or body text containing 'Download Photos and Videos'.
Page 26 of 40