Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
Detects incoming email messages containing PDF attachments from 'gasparinutrition.com' that either have suspicious filenames indicating legal or contractual documents or contain external links redirecting to non-domain URLs. These indicators are consistent with credential harvesting or phishing campaigns.
Detects phishing emails where the sender domain (gasparinutrition.com) is spoofed or compromised. The emails are routed through Google Workspace infrastructure (gappssmtp.com) which results in a DMARC alignment failure under strict policies (adkim=s; aspf=s). The rule specifically flags emails containing PDF attachments with subject lines related to distribution, settlement, or agreements.
Detects the attacker leveraging a stolen session token to create or modify inbox rules that move finance or payroll related emails to the Archive or Trash folders, or delete them, as observed in Tycoon2FA phishing campaigns.
This rule detects potentially unauthorized or suspicious Google Forms collaboration invitations delivered via email. It filters for emails that pass full sender authentication (SPF, DKIM, and DMARC) and originate from Google infrastructure, while containing a specific Google Forms editor invite URL pattern. The rule excludes internal organizational communications from the Google domain and identifies specific return-path domains commonly associated with automated Google Forms sharing notifications to highlight external or unexpected collaboration requests.
Detects phishing emails that impersonate Scotiabank using the 'From' display name, while originating from a non-scotiabank.com domain. The rule identifies emails that bypass SPF and DMARC checks and originate from GoDaddy-hosted email services, as indicated by the 'X-SECURESERVER-ACCT' header, suggesting the use of a compromised small-business account.
Detects incoming emails originating from Google infrastructure (Gmail or Google Forms) where the sender's display name closely matches the recipient's local username part. This heuristic is commonly used to identify targeted spearphishing campaigns where attackers impersonate internal users or trusted entities via abuse of legitimate Google services.
This rule detects potentially malicious email messages masquerading as Google Forms collaboration invitations. It identifies emails originating from Google-related domains that contain URLs for Google Forms with invite parameters. The detection logic filters for messages passing SPF, DKIM, and DMARC authentication checks to highlight legitimate-looking emails that may be part of a social engineering campaign, and flags instances where the sender's display name matches the recipient's name as a high-risk indicator of impersonation.
This rule monitors for two distinct suspicious activities: 1) Inbound emails where the sender display name matches a list of executive titles, commonly indicative of Business Email Compromise (BEC) or executive impersonation attacks; 2) The creation of cloud service accounts with names mimicking administrative or IT support roles, which may indicate an adversary establishing persistent, privileged access.
Inbox Rule Notification Suppression
Cortex XDR
Detects the creation or modification of inbox rules designed to hide security and MFA notifications by deleting, marking as read, or moving them to hidden folders. This technique is commonly used post-compromise to suppress alerts about rogue device enrollment, sign-ins, or password changes, preventing the victim from discovering an account takeover. It is a frequent Business Email Compromise (BEC) and Account Takeover (ATO) persistence technique.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign leveraging compromised legitimate domains to bypass email authentication controls.
This rule detects potentially malicious invoice-themed emails by monitoring email gateway telemetry for a combination of failing email authentication checks (DKIM, SPF, DMARC) and domain mismatches, which are indicative of spoofing attempts.
Detects inbound invoice-themed phishing emails where the sender domain authentication (SPF/DKIM) fails, combined with healthcare-related display name impersonation. The rule specifically targets the abuse of aged, high-reputation domains used as a vector to bypass standard reputation-based email filtering while masquerading as healthcare organizations.
Identifies Azure Active Directory (AAD) logins from new or unusual locations followed immediately by the creation of inbox rules designed to delete incoming emails. This behavior is indicative of an attacker gaining access to an email account and attempting to disrupt communication or hide their activities by automatically deleting legitimate emails.
Detects incoming phishing emails leveraging Scotiabank and Interac branding for Telephone Oriented Attack Delivery (TOAD). These emails utilize HTML attachments or body content containing specific toll-free numbers (1-800-472-6) and financial lures related to unauthorized Interac e-Transfers, aiming to deceive recipients into initiating a callback.
Detects a spear-phishing email masquerading as AWS Support services originating from a specific compromised university account (awsservices@presby.edu). This rule identifies malicious emails associated with the PoisonSeeds AiTM (Adversary-in-the-Middle) phishing campaign, which uses support ticket lures to harvest credentials.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects inbound email events that impersonate Scotiabank, contain financial urgency lures related to Interac e-Transfers, and include suspicious HTML attachments or .eml files. The rule specifically looks for HTML attachments or .eml files with specific naming conventions ('v-mail_' prefix or '.mp3.eml' suffix) and a file size between 7KB and 8KB, or any HTML attachment. It also checks for sender display name impersonation of Scotiabank while the sender's actual domain is not scotiabank.com.
Detects inbound messages whose subject closely matches the campaign's reported stolen client data extortion wording. The rule looks for specific keywords like 'lost', 'confidential', 'data', 'clients' (all present) and 'very important', 'important', 'client data' (any present) in the email subject, specifically for inbound emails that are either the first contact or have no threat types identified.
This rule detects email events where the sender's domain fails basic DNS resolution, indicating it might be non-existent or invalid, but the email successfully bypasses authentication due to SPF macros. This could be an attempt to spoof emails from non-existent domains while still appearing legitimate to email authentication checks.
Detects a new mailbox rule that deletes, moves, redirects, or marks as read messages containing security, sign-in, MFA, alert, or administrator terms. This behavior is often indicative of an adversary attempting to hide their activities or prevent detection by preventing security notifications from reaching the user.
Detects the creation or modification of inbox rules that automatically mark emails as read and move them to a folder. This behavior is commonly used by adversaries to hide phishing replies or other malicious email activity from the victim's primary inbox.
Page 28 of 40