Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
53
Contributors
49
4
Categories
33
23
21
14
12
Platforms
53
Products / Services
53
4
2
2
1
MITRE Techniques
23
10
7
7
6
IDS Classtypes
1,937
503
461
381
236
53
IDS Protocols
42
9
2
This rule detects attempts to capture credentials via an 'Evil Twin' access point by looking for HTTP POST requests to URIs containing both 'login' and 'wifi'. This combination suggests a malicious captive portal designed to trick users into submitting their credentials.
This rule detects HTTP responses from a server to a client that contain specific keywords ('remote', 'support', 'download') within the file data, indicating a potential fake IT support page attempting to deliver a remote access tool. The rule also checks for a minimum file size to reduce false positives.
This rule detects HTTP responses that appear to be a phishing kit landing page. It looks for specific keywords in the HTTP response body, such as 'img', 'logo', 'password', and 'Submit', indicating a page designed to collect credentials. Additionally, it checks if the HTTP host is an IP address, which is often used in phishing campaigns to bypass domain-based reputation checks or to host pages directly on compromised servers.
This rule detects potential phishing emails sent over SMTP that request sensitive information. It looks for specific keywords in the email subject and content, such as "verify", "account", and "click here", indicating an attempt to trick the recipient into revealing credentials or other sensitive data.
This rule detects HTTP POST requests where the client body contains the keywords 'company', 'role', and 'email' (case-insensitive). This combination of keywords in a POST request body is indicative of a phishing reconnaissance attempt, where an attacker is trying to collect organizational data through a form submission.
This rule detects bulk phishing campaign delivery by monitoring SMTP traffic for a high volume of emails containing the 'Subject:' header. Specifically, it triggers an alert if 20 or more emails with a 'Subject:' header are sent to the internal network (HOME_NET) on port 25 within a 60-second window from the same source.
This rule detects HTTP responses that contain content indicative of a survey lure page used for information gathering. It specifically looks for the presence of keywords such as 'survey', 'name', 'email', and 'company' within the HTTP response body, suggesting an attempt to collect personal or organizational information.
This rule detects potential credential phishing pages served to a user over HTTP. It looks for HTTP responses containing both "Enter your password" and "Sign in" (case-insensitive) in the file data, and where the HTTP host is an IP address rather than a domain name. This combination of indicators suggests a generic phishing attempt designed to trick users into providing their credentials.
This rule detects web pages served to clients that contain characteristics commonly associated with tech support scams. Specifically, it looks for HTTP responses containing the words "call", "1-800", and "virus" (case-insensitive) in the file data. This combination of keywords suggests an attempt to trick users into calling a fake support number due to a fabricated "virus" infection.
MFA OTP Phishing Page Detected
Suricata
This rule detects potential MFA OTP phishing pages by inspecting HTTP URIs for the presence of both 'verify' and 'otp' keywords, case-insensitively. This combination in a URI is indicative of a page designed to trick users into submitting their One-Time Passwords (OTPs) for multi-factor authentication.
This rule detects potential phishing landing pages by looking for HTTP responses that contain both 'login' and 'microsoft' in the URI, and where the HTTP host is an IP address. This combination suggests an attempt to mimic a Microsoft login page hosted on an IP address rather than a legitimate domain, which is a common tactic in phishing attacks.
Page 3 of 3