Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
315 detections
Filters
Last updated
All Time
Detection languages
140
65
56
27
13
Contributors
116
51
30
16
13
Categories
94
93
89
75
71
Platforms
116
85
80
75
62
Products / Services
95
84
60
53
42
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
1
1
IDS Classtypes
32
31
1
1
1
IDS Protocols
41
13
2
2
1
Detects inbound emails impersonating IT support or helpdesk staff that utilize urgent pretexts related to passkey, MFA, or SSO updates. These lures are commonly used in phishing campaigns to direct users toward malicious authentication flows, such as AiTM or device-code phishing setups.
This rule detects network activity (HTTP requests or DNS queries) interacting with specific suspicious domains that mimic Microsoft 365, Purview, or DocuSign authentication pages. These domains are identified by specific naming patterns and content markers indicative of credential harvesting or device code phishing attacks.
This rule detects network traffic where the TLS Server Name Indication (SNI) field claims to be 'gemini.google.com', but the traffic is being directed to a non-Google destination. This is often indicative of an Adversary-in-the-Middle (AiTM) attempt to intercept or redirect traffic intended for legitimate AI service domains.
This rule detects network traffic directed to the subdomain 'testing.perplexity.com', which is identified as being associated with the BragJack campaign. This specific subdomain is leveraged by the campaign to facilitate browser session redirect bypasses, indicative of an attempt to intercept or manipulate user sessions.
Detects anomalous device-code authentication attempts from multiple distinct users originating from known ARToken PhaaS platform egress IP addresses within a 3-day window. This behavior is indicative of a bulk token-capture operation, where an attacker leverages an Adversary-in-the-Middle (AiTM) phishing framework to harvest credentials and session tokens from multiple users.
Detects outbound WebSocket upgrade requests from internal network assets to known IronToll C2 IP addresses, restricted to requests whose Host header ends in one of the disposable TLDs observed across the campaign's 73+ rotating lookalike domains (.cfd, .sbs, .shop, .icu, .buzz, etc). This narrows the alert to the campaign's actual phishing-domain pattern rather than any WebSocket traffic that happens to reach the same shared Tencent/Alibaba cloud IPs, and a per-source threshold caps repeat alerts from the same host to one per hour.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
Detects user authentication events that exhibit patterns consistent with Adversary-in-the-Middle (AiTM) phishing campaigns, specifically those leveraging passkey or SSO-themed lures and device-code authentication flows.
Detects anomalous sign-in behavior shortly after a successful MFA-authenticated session in Microsoft 365. This rule flags scenarios where a subsequent session for the same user occurs within a short window (30 minutes) from a different IP, ASN, User-Agent, or device identifier, potentially indicating the replay of a stolen session cookie obtained via Adversary-in-the-Middle (AiTM) phishing.
Detects anomalous reuse of an authenticated Microsoft 365 session cookie shortly after a successful MFA-satisfied sign-in. The detection identifies scenarios where the subsequent access originates from a different IP address, device, or user agent without an intervening MFA challenge, which is a pattern indicative of session hijacking techniques like Adversary-in-the-Middle (AiTM) or session token replay.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
Detects DNS queries and TLS SNI traffic directed towards known malicious domains associated with passkey and SSO phishing campaigns, specifically attributed to Storm-3121 and Storm-3032. These domains are used to deceive users into providing credentials or authentication tokens via fraudulent login portals.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
This rule detects network activity associated with GhostCode phishing campaigns. It monitors for suspicious TLS SNI fields and HTTP Host headers matching known device-code phishing subdomain patterns (e.g., [service]-access-[8-chars].[domain]). Additionally, it detects requests to specific known malicious hostnames and high-entropy URI paths indicative of phishing kit redirects.
This rule monitors network connections, DNS resolutions, and email URLs to detect traffic communicating with a known adversary-in-the-middle (AiTM) phishing infrastructure panel. By correlating security logs, DNS events, and email URL data against this specific indicator of compromise, it identifies potential interaction with phishing sites designed to capture credentials or session tokens.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects outbound WebSocket upgrade requests from internal network assets to known IronToll C2 IP addresses, restricted to requests whose Host header ends in one of the disposable TLDs observed across the campaign's 73+ rotating lookalike domains (.cfd, .sbs, .shop, .icu, .buzz, etc). This narrows the alert to the campaign's actual phishing-domain pattern rather than any WebSocket traffic that happens to reach the same shared Tencent/Alibaba cloud IPs, and a per-source threshold caps repeat alerts from the same host to one per hour.
Detects outbound TLS and HTTP traffic directed towards 'testing.perplexity.com', an unlocked test subdomain reportedly associated with the BragJack campaign for AI agent hijacking. This indicates potential interaction with an adversary-controlled or compromised infrastructure used to intercept or manipulate AI agent sessions.
Page 6 of 15