Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This rule monitors email attachment events for PDF files containing specific, repetitive text patterns often associated with phishing templates or document-based social engineering. It detects attachments that include phrases like 'lorem ipsum' variations or specific professional-sounding but potentially suspicious terms like 'Investor Accounts Producer' or 'Settlement Agreement' which may indicate an attempt to entice a user into reviewing fraudulent documentation.
This rule detects potentially malicious activities involving Microsoft Copilot and Microsoft Graph, specifically focusing on unauthorized mailbox access via non-interactive sessions and patterns indicative of Server-Side Request Forgery (SSRF) during search operations. It monitors for anomalous interaction with the Graph API, specific Copilot search parameters, and suspicious image search requests.
This rule detects potential email spoofing attempts where an email claims to originate from a specific domain ('gasparinutrition.com') or is intended for external recipients, but fails critical authentication checks. Specifically, it identifies emails with DMARC failure, SPF failure, and a suspicious DKIM signing domain associated with 'gappssmtp.com', indicating an attempt to bypass sender authentication mechanisms.
Detects the threat actor creating inbox rules to delete or archive emails containing keywords like "deposit", "payroll", "HR", "Workday", or "ADP" to hide their tampering, often associated with the Storm-2755 campaign.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
This rule detects a multi-stage attack sequence where a user is subjected to a 'spam bomb' (large volume of inbound emails in a short time), followed by an external Microsoft Teams contact, and concluding with the execution of legitimate remote support tools (Quick Assist or MSRA) on the victim's endpoint, which is a common pattern for social engineering and technical support fraud.
Detects the creation or modification of inbox rules in Exchange/Office 365 that both apply an email suppression action (move to folder, delete, or mark as read) and filter for security-themed keywords (e.g., 'phish', 'MFA', 'SOC'). This behavior is commonly used by adversaries to hide security alerts, multi-factor authentication (MFA) prompts, or phishing incident notifications from a compromised user's mailbox.
Detects the creation or modification of inbox rules in Exchange/Office 365 that both apply an email suppression action (move to folder, delete, or mark as read) and filter for security-themed keywords (e.g., 'phish', 'MFA', 'SOC'). This behavior is commonly used by adversaries to hide security alerts, multi-factor authentication (MFA) prompts, or phishing incident notifications from a compromised user's mailbox.
This rule monitors inbound emails that exhibit signs of phishing, specifically looking for failures in email authentication protocols (DKIM, DMARC), the use of specific invoice-themed subject lines, and the inclusion of redirection links pointing to known third-party collaboration platforms (HolaBrief, LoopedIn). It also identifies cases where the sender's envelope domain differs from the header's 'From' domain, which is a common indicator of email spoofing used in identity-based attacks.
Detects potential invoice-themed phishing campaigns by identifying inbound emails that simultaneously target multiple recipients from senders with whom the organization has no prior communication history. The detection specifically flags emails with authentication failures (DKIM, SPF, or ARC) in the subject line, which is a common pattern for phishing attacks attempting to bypass reputation filters using aged domains.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects phishing emails leveraging Telephone-Oriented Attack Delivery (TOAD). These emails impersonate Scotiabank and use urgent themes regarding unauthorized $3,000 Interac e-Transfers to lure victims into calling an attacker-controlled toll-free number. The rule monitors for specific email subjects and attachments masquerading as voicemail audio files (v-mail*.mp3.eml or v-mail*.html).
This rule detects potentially malicious emails that leverage Calendly as a lure. It looks for emails that pass standard authentication (SPF/DKIM/DMARC) but contain suspicious elements such as URLs redirecting to Calendly or Google, subject lines related to common social engineering themes (complaints, health inspections, etc.), or the presence of ZIP attachments that match common photo/image naming patterns.
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies specific malicious attachment filenames, suspicious URLs, subject lines, and sender domains commonly used in these campaigns to deliver malicious content.
Identifies inbound emails leveraging the HR-themed "Code of Conduct" or "Employee Policy" subjects often used to trigger the AiTM campaign.
This rule monitors for suspicious emails involving the 'gasparinutrition.com' domain, specifically looking for indicators such as DMARC failures, spoofed display names (e.g., 'monitoring'), or attachments with file names related to business documents like distribution, settlement, or agreements. It also triggers on DNS queries for the same domain, which could indicate related outbound communications or C2 activity.
Detects inbound emails from external domains that leverage generic automated sender display names (e.g., 'DocuSign', 'No-Reply') and deliver PDF attachments with lure filenames commonly associated with document-based phishing campaigns (e.g., 'Agreement', 'Settlement'). The rule specifically monitors for these indicators when the subject line also contains executive-level keywords, indicating a targeted phishing attempt against C-Suite personnel.
This rule monitors for incoming emails that pass DKIM authentication but fail DMARC verification, specifically where the signing domain is associated with Google Apps (gappssmtp.com). This pattern is often indicative of email spoofing, where an attacker sends mail from a legitimate provider's infrastructure but fails the domain alignment requirements of DMARC.
Detects incoming emails with specific subject lines or attachment names relating to 'distribution settlement agreement' or 'agreement settlement' that arrive as PDF attachments. The rule calculates a risk score based on sender domain reputation (known malicious), DMARC/DKIM authentication mismatches, and potential display name spoofing to identify phishing attempts.
Detects incoming emails that claim to be from a 'Monitoring' display name associated with the gasparinutrition.com domain or specific accounting sender address, which may indicate a spearphishing or impersonation attempt.
This rule identifies emails originating from or claiming to be from the domain 'gasparinutrition.com' or the specific address 'accounting2@gasparinutrition.com' while using the display name 'Monitoring'. This is a common pattern observed in phishing or social engineering campaigns where adversaries impersonate internal or trusted organizational functions.
Page 27 of 40