Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This rule monitors incoming email events for potential phishing attempts by identifying messages from unknown sender domains (not seen in the last 90 days) that contain known AI-generated response phrases in the subject line or personalized content matching the recipient's display name. This helps detect spearphishing lures that attempt to build trust through impersonation or leverage LLM-generated phrasing common in automated phishing campaigns.
This rule identifies email patterns that involve either the presence of email attachments (specifically .eml or .msg files) or common email forwarding/reply indicators (e.g., 'FW:', 'FWD:', 'RE:'). By aggregating emails based on the sender and subject, it provides a summary of communication volume, which can be used to identify anomalous email activity or potential phishing staging/thread hijacking.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects the creation of mailbox inbox rules (New-InboxRule) or modification of mailbox forwarding configurations (Set-Mailbox) that auto-forward, auto-delete, or move messages to hidden or secondary folders (e.g., RSS, Deleted Items). This behavior is characteristic of Business Email Compromise (BEC) follow-on activity intended to maintain covert access to victim communications, particularly following account takeover events like password resets.
This rule detects the creation or modification of Exchange mailbox rules (Forward, Redirect, Delete, or Mark as Read) involving sensitive keywords (invoice, wire, payment, finance, remittance) shortly after an anomalous sign-in event or a password reset on the same account. This combination is a strong indicator of account takeover and mailbox persistence.
Detects high-volume email inflow to a single recipient mailbox within a 15-minute timeframe. The rule specifically monitors for subject lines commonly associated with subscription confirmations or newsletters, indicating a potential email bombing or mail flood attack designed to overwhelm a user's inbox or hide malicious communications.
Detects high-volume, diverse administrative and discovery activities in cloud environments, including SharePoint site enumeration, Azure AD user/identity discovery, and suspicious access to mail items via specific client applications, potentially indicating post-compromise reconnaissance or data harvesting.
This rule detects incoming email messages containing .zip attachments with filenames that mimic financial documents (e.g., NFe, DANFE, invoice-related keywords) combined with numerical strings. This naming pattern is commonly associated with phishing campaigns attempting to deliver malicious archives.
Detects incoming emails processed by Rspamd that exhibit suspicious authentication header signatures. The rule identifies emails lacking DKIM, ARC, or user agent information while simultaneously showing a zero receive count, potentially indicating spoofed, unauthenticated, or malformed phishing attempts.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
Detects downstream delivery of likely AI-paraphrased mass-produced lure content by identifying bursts of near-duplicate subject lines from newly-seen domains with auth failures.
Detects downstream delivery of likely AI-paraphrased mass-produced lure content by identifying bursts of near-duplicate subject lines from newly-seen domains with auth failures.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
This rule detects phishing emails associated with the 'AnonyMousKIT' campaign that spoof Apple-related services ('Find My', 'Apple Support') using common adversary-controlled Gmail/iCloud addresses. The rule specifically targets institutional recipients in .gov, .edu, and .ac domains, identifying potential credential harvesting attempts despite the campaign's original consumer-focused pretext.
This rule monitors email traffic for attachments with suspicious file types (.htm, .xhtml, .svg, .zip) or specific filenames commonly used in phishing campaigns. It focuses on emails associated with Amazon SES infrastructure, often indicative of phishing attempts leveraging reputable infrastructure to deliver malicious content or stager files.
Detects potential token-replay persistence by identifying repeated 'MailItemsAccessed' events for the same user account from a non-native 'REST' and 'Firefox' client string, recurring at consistent ~30-minute intervals.
Detects anomalous access to email items in Microsoft 365 Exchange environments by monitoring the 'MailItemsAccessed' operation. The rule flags specific, non-standard pairings of 'ClientAppId' and 'APIId' associated with malicious activity, indicating potential unauthorized data collection or exfiltration by attackers bypassing standard Outlook client behavior.
Page 9 of 40