Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
53
Contributors
49
4
Categories
33
23
21
14
12
Platforms
53
Products / Services
53
4
2
2
1
MITRE Techniques
23
10
7
7
6
IDS Classtypes
1,937
503
461
381
236
53
IDS Protocols
42
9
2
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
This rule detects HTTP requests that contain both 'otp' and 'verify' in the URI, which is indicative of a phishing page designed to capture One-Time Passwords (OTP) or Multi-Factor Authentication (MFA) codes. The rule is specifically looking for patterns associated with reverse proxy phishing techniques.
This rule detects potential phishing attempts involving malicious file sharing via OneDrive. It specifically looks for HTTP traffic directed to 'onedrive.live.com' with 'sharing' in the URI. A threshold is set to trigger an alert if five such events occur from the same source within 60 seconds, indicating a potential automated or repeated attempt to share malicious content.
This rule detects HTTP responses from a server to a client that contain the phrase "Your computer is infected" (case-insensitive). This is indicative of a fake security alert page, often used in social engineering attacks to trick users into downloading malware or providing credentials. The rule specifically looks for this content within the file data of an established HTTP flow directed to the client.
This rule detects emails sent to the internal network (SMTP port 25) that attempt to impersonate an internal IT department. It specifically looks for the 'From:' header, the phrase 'IT Department' (case-insensitive), and the word 'password' (case-insensitive) within the email content. This combination suggests a social engineering attempt, likely phishing, to trick recipients into revealing credentials.
This rule detects potential MFA bypass attempts using Evilginx by looking for HTTP POST requests to the server that contain both 'session' and 'token' in the URI, with a body size greater than 100 bytes. This pattern is indicative of session token capture, a technique used by Evilginx to bypass multi-factor authentication.
This rule detects a potential MFA SMS code request flooding attack. It triggers when a single source IP address makes 10 or more HTTP requests containing the string "send_code" in the URI within a 60-second window. This behavior is indicative of an attacker repeatedly attempting to request MFA codes, likely in an attempt to overwhelm the user or the system, or to facilitate a SIM-swapping attack.
This rule detects HTTP traffic that appears to be a fake IT helpdesk page attempting to host a remote tool. It looks for the keywords "helpdesk", "download", and "remote" (case-insensitive) within the file data of HTTP responses. This combination of keywords suggests a social engineering attempt to trick users into downloading and executing remote access software under the guise of IT support.
This rule detects SMTP traffic where an email is failing SPF (Sender Policy Framework) authentication. Specifically, it looks for the 'Received-SPF: fail' header in emails sent to port 25 ($HOME_NET). This indicates that the sending server is not authorized to send email on behalf of the domain specified in the email's 'MAIL FROM' address, which is a strong indicator of a phishing attempt or spoofed email.
This rule detects attempts to hijack the clipboard on a web page by identifying HTTP responses (flow:to_client) that contain both 'clipboardData' and 'setData' (case-insensitive) in the file data. This combination of keywords suggests a script attempting to read from and write to the client's clipboard, which is a common technique for clipboard hijacking.
This rule detects HTTP traffic to 'teams.microsoft.com' with a URI containing '/messages/'. It is designed to identify potential social engineering attempts where malicious links are delivered via Microsoft Teams messages. The rule uses a threshold of 5 occurrences within 60 seconds from the same source IP to reduce false positives.
This rule detects HTTP responses that appear to be phishing pages designed to capture credentials. It specifically looks for HTTP traffic flowing to the client that contains both the words "password" and "submit" (case-insensitive) in the file data, and where the HTTP host is an IP address. This combination suggests a credential input form on a page served from an IP address, which is a common characteristic of phishing attempts.
This rule detects potential credential phishing attempts by identifying HTTP URIs that contain the keywords 'redirect', 'login', and 'microsoft' (case-insensitive). This combination of keywords in a URI is often indicative of a phishing link designed to trick users into providing credentials, especially targeting Microsoft accounts, by redirecting them to a fake login page.
This rule detects potential adversary-in-the-middle (AiTM) phishing attempts, specifically those leveraging tools like Evilginx. It triggers on HTTP requests where the URI contains the keywords "verify", "session", and "token" (case-insensitive). This combination of keywords in the URI is indicative of phishing pages designed to capture session tokens or verification codes.
This rule detects HTTP responses containing a PDF file that also includes the string "/URI" and "login" (case-insensitive). This combination is indicative of a malicious PDF credential phishing page being served to a client. The rule specifically looks for the PDF magic bytes at the beginning of the file data.
This rule detects suspicious HTTP traffic indicating a LinkedIn message that contains an external link. It specifically looks for HTTP requests to 'linkedin.com' with a URI containing '/messaging/' and triggers if 10 such events occur within 60 seconds from the same source IP address. This pattern is often associated with social engineering attempts where attackers use LinkedIn messaging to direct users to malicious external sites.
This rule detects potential credential phishing attempts by identifying HTTP responses (flow:to_client,established) that contain common keywords associated with login pages, specifically 'password', 'username', and 'action='. The rule looks for these keywords within the file data of the HTTP response, indicating a web page being served to the client that mimics a login form.
This rule detects HTTP responses that contain specific keywords indicative of a fake CAPTCHA paste attack page. It looks for the terms "CAPTCHA", "paste", and "Win+R" (case-insensitive) within the HTTP response body. This combination suggests a social engineering attempt where users are tricked into pasting malicious content, often after being instructed to open the 'Run' dialog (Win+R).
Page 1 of 3