Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
165
46
37
9
9
Contributors
60
46
36
25
20
Categories
101
78
76
66
59
Platforms
144
61
58
22
17
Products / Services
81
66
44
38
32
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
3
1
IDS Classtypes
34
7
4
1
IDS Protocols
38
5
1
1
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects instances where the Windows Explorer process (the parent of the 'Run' dialog) spawns common command-line interpreters. This behavior is indicative of the 'ClickFix' phishing technique, where users are socially engineered to paste malicious commands into the Windows Run dialog.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Detects the execution of mshta.exe with arguments pointing to remote URLs or containing JavaScript. This behavior is commonly associated with phishing campaigns where attackers use fake CAPTCHA lures to trick users into executing malicious scripts via mshta.exe, often launched directly from Windows Explorer (e.g., from a downloaded file).
This rule detects potential ClickFix/InstallFix attacks where a user is socially engineered to copy and paste a malicious command from a website that mimics a legitimate developer tool installation (e.g., Claude Code, NotebookLM). The detection flags the use of common download-and-execute cmdlets (e.g., irm, iwr, iex) within common Windows shell interpreters while excluding known legitimate vendor install domains.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects a suspicious sequence of browser navigation/redirection events followed shortly by the manual execution of command-line utilities (PowerShell, CMD, or MSHTA) via explorer.exe, characteristic of 'ClickFix' social engineering attacks where users are tricked into copying and executing commands from their clipboard.
Detects instances where PowerShell or pwsh processes are initiated directly by explorer.exe containing command-line arguments indicative of obfuscated or hidden execution, often used in ClickFix-style social engineering attacks where victims are coerced into pasting malicious commands into the Windows Run dialog.
Page 1 of 14