Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
26
1
Contributors
16
6
4
1
Categories
15
11
9
6
5
Platforms
26
1
1
Products / Services
24
10
1
1
MITRE Techniques
6
5
3
3
3
CVEs
2
IDS Classtypes
9
9
3
3
2
IDS Protocols
2,431
868
408
324
97
27
This rule detects an 'Email Subscription Bomb' attack, where an attacker automates sign-ups to various services using a victim's email address. The goal is to flood the victim's inbox with confirmation emails, potentially causing a denial of service or distracting them from other malicious activities. The rule specifically looks for SMTP traffic to port 25 containing the phrase 'confirm your subscription' (case-insensitive) and triggers an alert if this content is seen 50 times within 60 seconds from the same destination IP address.
This rule detects spearphishing emails sent over SMTP that contain an Office document attachment. It specifically looks for emails with a 'Content-Type: application/' header, a 'filename=' attribute, and the '.docx' extension in the content, indicating a Microsoft Word document.
This rule detects email attachments with VBScript extensions (.vbs, .vbe) delivered via SMTP. It specifically looks for the filename attribute in the email flow to the server, indicating a potential malicious script delivery.
This rule detects potential phishing emails sent over SMTP that request sensitive information. It looks for specific keywords in the email subject and content, such as "verify", "account", and "click here", indicating an attempt to trick the recipient into revealing credentials or other sensitive data.
This rule detects bulk phishing campaign delivery by monitoring SMTP traffic for a high volume of emails containing the 'Subject:' header. Specifically, it triggers an alert if 20 or more emails with a 'Subject:' header are sent to the internal network (HOME_NET) on port 25 within a 60-second window from the same source.
This rule detects a high volume (50 or more) of failed authenticated SMTP login attempts to Office 365 Exchange Online from a single IP address within a 24-hour period. The failures are specifically for error codes 50126 (invalid username or password) or 50053 (account locked). This pattern is indicative of a brute-force or password-guessing attack against Exchange Online accounts.
Page 2 of 2