Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
6
1
Contributors
3
3
1
Categories
5
4
2
2
2
Platforms
3
2
2
1
1
Products / Services
3
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects credential harvesting portals from evil twin Wi-Fi access points
Detects evil twin access point credential capture portal
This rule detects network traffic indicative of an 'Evil Twin' access point credential capture portal. It specifically looks for HTTP POST requests where the URI contains both 'wifi' and 'password' (case-insensitive). This pattern suggests a malicious portal designed to trick users into entering their Wi-Fi credentials.
Detecting networks shared by phones with key words in their Names such as "FREE", "AIRPORT" "OPEN", can be potential cases of Evil Twin Attack where malicious actors can intercept network traffic, steal login credentials, capture sensitive data, or launch further attacks like Man-in-the-Middle (MitM) attacks.
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
KQL Query from file: Hunting Rockstar 2FA
KQL Query
KQL Query from file: Muddled Libra