Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
165
46
37
9
9
Contributors
60
46
36
25
20
Categories
101
78
76
66
59
Platforms
144
61
58
22
17
Products / Services
81
66
44
38
32
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
1
IDS Classtypes
34
7
4
1
IDS Protocols
38
5
1
1
This rule identifies and analyzes user interactions with URLs embedded in emails, specifically focusing on emails that are either inbound or intra-organizational. It determines which users clicked on URLs within these emails and provides a summary of this activity. This analysis is particularly useful in security contexts, where understanding user behavior regarding potentially risky links can help in identifying phishing attacks or other malicious activities.
This rule detects suspicious command-line activity, specifically file downloads using 'curl' initiated by a web browser. This behavior may indicate malicious JavaScript or HTML triggering command execution, a user being tricked into clicking a link that launches a command, or initial access/payload download in a phishing or drive-by attack.
This rule detects suspicious ad click traffic that routes through Google Ad Services It specifically looks for URLs containing Google Click Identifier (gclid), an ad URL, and a placement ID, while excluding legitimate ad routing services. This could indicate ad fraud or malvertising.
Most but not all clicks on Google ads are routed this way.
Most but not all clicks on Google ads are routed this way.
This rule detects instances where an email with identified threats (e.g., malware, phishing) is received and a URL within that email is subsequently clicked by a user. It correlates email threat information with URL click events to identify successful user interaction with malicious links.
Detects the execution of mshta.exe spawning a command shell (cmd.exe) to download a remote file. This behavior is indicative of malicious HTA files used to deliver malware, as seen in campaigns distributing Epsilon Red ransomware.
This detection identifies emails containing links that use well-known URL shortening services (e.g., bit.ly, t.co, tinyurl.com). While these services are commonly used for legitimate purposes, they are frequently abused by threat actors to obfuscate malicious destinations. This detection joins EmailUrlInfo with EmailEvents to include sender metadata and filters out trusted senders based on a configurable watchlist (ShortenerSafeSenders).
Detects potential Unicode-based homograph attacks by scanning for non-ASCII characters in both DeviceNetworkEvents.RemoteUrl and EmailUrlInfo.Url. These attacks leverage visually deceptive domain names—using characters from non-Latin scripts (e.g., Cyrillic "а" instead of Latin "a")—to mimic legitimate sites and deceive users.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
Identifies command prompt execution from browsers with suspicious parameters, indicating potential ClickFix attacks where users are tricked into running malicious commands.
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
This rule detects the execution of common Windows utilities (PowerShell, Regsvr32, BITSAdmin, Certutil, MSHTA) when initiated by a web browser. This behavior can indicate an attempt to execute malicious code or download additional payloads after a user clicks a malicious link or visits a compromised website. Adversaries often leverage these utilities for various purposes, including code execution, file transfer, and bypassing security controls.
Hunting query to monitor downloads through popular browsers
KQL Query
KQL Query
KQL Query
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: M365 Copilot Gone Rouge
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: KQL URL Protection Report
KQL Query
KQL Query
Page 12 of 14