Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
165
46
37
9
9
Contributors
60
46
36
25
20
Categories
101
78
76
66
59
Platforms
144
61
58
22
17
Products / Services
81
66
44
38
32
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
3
1
IDS Classtypes
34
7
4
1
IDS Protocols
38
5
1
1
Detects Microsoft Copilot interaction URLs containing the 'autorun=1' parameter alongside a 'q=' prompt parameter. This combination indicates a potential attempt to execute a prompt in the user's Copilot session without explicit user confirmation upon link click, a technique sometimes referred to as a CoSnitch or one-click attack.
This rule detects browser-based runtime evaluations that utilize WebRTC's RTCPeerConnection and createDataChannel APIs, often indicative of an adversary attempting to establish a covert command-and-control (C2) channel directly from a compromised browser session.
Detects a victim's WhatsApp Web session being abused to automatically propagate ClickFix lure links to contacts, correlated with recent infection indicators.
Detects DNS queries to UNC6671 vishing-lure lookalike domains (createssopasskey/addssopasskey/passkeyhelpdesk) used to harvest credentials after a helpdesk-impersonation vishing call.
Detects inbound email lures impersonating a Microsoft Call Center voicemail notification, consistent with the Storm-2755 (Payroll Pirates) AiTM phishing campaign.
No description available.
Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.
This rule detects the multi-stage execution pattern characteristic of the AMOS stealer on macOS, where a terminal session is used to execute a base64-encoded payload piped into a shell interpreter. The rule specifically monitors for processes like curl, openssl, base64, and zsh being launched from a Terminal or shell parent, often involving specific command-line indicators or malicious URLs associated with the stealer's toolkit.
Detects Microsoft Defender XDR UrlClickEvents where a clicked URL or extracted clicked domain matches known Coinbase Cartel-related URL, onion, messaging, or infrastructure indicators.
Detects HTTP GET requests to UNC6692 Edgecution phishing landing pages hosted on S3 buckets using the 'service-page-*-outlook.s3.us-west-2.amazonaws.com' naming pattern with an 'email=' parameter and '/update.html' URI, used to lure victims into downloading the Edgecution malware suite via fake Outlook/Mailbox Repair Utility pages.
Detects execution of files named svchost32.exe or chrome_update.exe running from non-system paths (AppData, Temp, Downloads) that are unsigned or whose code-signing certificate does not match the expected legitimate signer (Microsoft/Google), indicative of the CornFlake RAT dropper used by Midnight Blizzard/Storm-2945 in the CaptiveCrunch campaign.
TLS beaconing to disposable AMOS distribution/redirector domain
Detects unauthorized credential validation attempts on macOS using the 'dscl -authonly' command. The rule identifies instances where suspicious interpreter processes (like bash, zsh, python, or curl) or their derivatives attempt to validate credentials via the Directory Service Command Line tool, while excluding known legitimate system and management processes.
KQL Query
KQL Query
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
Detects ClickFix social engineering used in the TELEPUZ/VIDAR campaign where a user is tricked into executing a PowerShell command that downloads a binary from memshowblob.forum using bypass flags and removes the Zone.Identifier ADS. Part of the CLICKFIX-VIDAR initial access chain delivering TELEPUZ MaaS malware.
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
Detects ClickFix social engineering used in the TELEPUZ/VIDAR campaign where a user is tricked into executing a PowerShell command that downloads a binary from memshowblob.forum using bypass flags and removes the Zone.Identifier ADS. Part of the CLICKFIX-VIDAR initial access chain delivering TELEPUZ MaaS malware.
Page 6 of 14