Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
53
Contributors
49
4
Categories
33
23
21
14
12
Platforms
53
Products / Services
53
4
2
2
1
MITRE Techniques
23
10
7
7
6
IDS Classtypes
1,937
503
461
381
236
53
IDS Protocols
42
9
2
This rule detects potential phishing attempts delivered via WhatsApp Business by monitoring HTTP traffic for connections to 'api.whatsapp.com' with 'message' in the URI. It specifically looks for a high volume (10 times in 60 seconds) of such connections from a single source, which could indicate an automated or widespread delivery of malicious links.
This rule detects emails sent over SMTP where the 'From:' and 'Reply-To:' headers are present, indicating a potential attempt to spoof the sender's display name while using a different domain. It triggers an alert if 10 such emails are observed from the same source within 60 seconds, suggesting a bulk email or phishing attempt.
This rule detects email spoofing attempts where the 'From' address domain does not match the 'Return-Path' address domain. It specifically looks for SMTP traffic on port 25, ensuring the flow is established and to the server. The rule uses PCRE to extract the domain from the 'From' header and then checks if the 'Return-Path' header contains a different domain.
This rule detects automated multi-factor authentication (MFA) push bombing attempts targeting Duo Security's API. It specifically looks for HTTP POST requests to 'api.duosecurity.com' and triggers an alert if 10 such requests are observed from the same source IP within a 30-second window. This behavior is indicative of an attacker repeatedly sending MFA push notifications to a user's device in an attempt to overwhelm them or trick them into approving a fraudulent login.
This rule detects a potential MFA fatigue attack by monitoring repeated HTTP requests to known MFA provider domains (duo.com, okta.com, microsoft.com) containing the string "auth" in the URI. A threshold of 20 requests within 60 seconds from the same destination IP address triggers the alert, indicating an attacker might be repeatedly sending push notifications to a user's device to overwhelm them into accepting an authentication request.
This rule detects network traffic indicative of an 'Evil Twin' access point credential capture portal. It specifically looks for HTTP POST requests where the URI contains both 'wifi' and 'password' (case-insensitive). This pattern suggests a malicious portal designed to trick users into entering their Wi-Fi credentials.
This rule detects potential reverse proxy phishing pages by looking for HTTP URI requests that contain the keywords 'verify', 'account', and 'secure' (case-insensitive). The presence of these keywords in the URI of an HTTP request, particularly when combined, can indicate an attempt to mimic legitimate login or account verification pages, often used in phishing attacks.
This rule detects phishing emails sent over SMTP that contain macro-enabled documents (Word or Excel files) as attachments. It specifically looks for base64 encoded content, the 'filename=' attribute, and uses a PCRE to identify common macro-enabled file extensions like .doc, .docx, .xls, .xlsm, and .xlsb within the filename.
This rule detects HTTP traffic where the URI contains common URL shortener domains (bit.ly, tinyurl, t.co, ow.ly, is.gd) and also contains the string "login" (case-insensitive). This combination is often indicative of phishing attempts that use URL shorteners to obscure malicious links, leading users to fake login pages.
This rule detects phishing emails that deliver survey or form lures by identifying specific content patterns within SMTP traffic. It looks for emails with 'Content-Type: application/' and 'filename=' headers, specifically targeting attachments with file extensions like .doc, .docx, .pdf, or .xlsx, which are commonly used in social engineering attacks to deliver malicious documents or forms.
This rule detects web pages that are likely part of a bank vishing callback scam. It looks for HTTP responses (flow:to_client) containing the keywords 'call', 'toll-free', and 'account' (case-insensitive) in the file data. This combination of keywords suggests a page designed to trick users into calling a fraudulent number to discuss their 'account'.
This rule detects HTTP responses from a server to a client that contain the case-insensitive strings "IT Support", "helpdesk", and "password" within the file data. This combination of keywords suggests a web page designed to impersonate IT support, potentially for phishing or credential harvesting purposes.
This rule detects spearphishing emails sent over SMTP that contain an Office document attachment. It specifically looks for emails with a 'Content-Type: application/' header, a 'filename=' attribute, and the '.docx' extension in the content, indicating a Microsoft Word document.
This rule detects attempts to harvest credentials using a fake Microsoft login page. It triggers when HTTP traffic from the server to the client contains both "microsoftonline" and "password" in the file data, and the HTTP host is an IP address. This combination suggests a phishing attempt where a malicious server is impersonating a Microsoft login page to capture user credentials.
This rule detects potential phishing attempts delivered via Slack messages. It triggers when HTTP traffic to 'slack.com' contains '/messages/' in the URI, indicating a Slack message context, and has a threshold of 5 occurrences within 60 seconds from the same source.
This rule detects potential credential harvesting attempts by monitoring HTTP POST requests that contain both 'password' and 'email' in the client body. It specifically looks for these keywords in a case-insensitive manner within the HTTP client body and requires the body size to be greater than 50 bytes. This indicates a form submission likely containing sensitive user credentials.
This rule detects HTTP requests that appear to be credential phishing attempts, specifically looking for pages that might also attempt to bypass multi-factor authentication (MFA). It triggers when an HTTP URI contains the keywords "token", "verify", and "auth" (case-insensitive). This combination of keywords in the URI suggests a page designed to collect credentials and potentially an MFA bypass token.
This rule detects attempts to access typosquatted domains commonly used in phishing attacks. It specifically looks for HTTP requests where the host header contains variations of popular brand names like 'microsoft', 'google', 'paypal', 'amazon', and 'linkedin' with common typos (e.g., 'micros0ft', 'g00gle', 'paypa1', 'arnazon', 'linkedln'). The rule triggers on established HTTP connections to the server.
This rule detects HTTP traffic where the HTTP referer header indicates a social media platform (LinkedIn, Twitter, Facebook, Instagram) and the HTTP URI contains the string 'login'. This combination suggests a potential social media phishing attempt, where a user is redirected from a legitimate social media site to a credential harvesting page.
This rule detects HTTP traffic where the User-Agent header contains 'Microsoft', 'Google', or 'Amazon' (case-insensitive) and the Host header contains an IPv4 address. This combination could indicate an attacker impersonating a legitimate vendor's API client while making direct IP-based requests, potentially bypassing DNS-based security controls or targeting internal services.
This rule detects potential rogue captive portal credential harvesting pages by inspecting HTTP responses for the presence of keywords like 'captive', 'password', and 'connect' within the file data. These keywords, when found together in a client-bound HTTP response, suggest an attempt to mimic a legitimate captive portal to steal user credentials.
Page 2 of 3