Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects successful device code authentication via the Microsoft Office App (FOCI), which could indicate potential Adversary-in-the-Middle (AiTM) phishing attacks. The rule specifically looks for successful sign-ins using the 'deviceCode' authentication protocol and the AppId associated with Microsoft Office.
Identifies successful device code authentication followed by a high volume of file downloads within a short timeframe, which could indicate data exfiltration after an adversary has gained access through a device code phishing campaign.
Identifies logins from geographically distant locations occurring faster than physically possible, highlighting proxy infrastructure. This KQL query analyzes Google Workspace login success events, grouping them by account and a 10-minute time window. It then filters for instances where an account has successfully logged in from two or more distinct locations within that short timeframe, indicating potential impossible travel.
Detects anomalous WebSocket connections that transmit DOM serialization data using the rrweb library. This activity is indicative of a Browser-in-the-Middle (BitM) phishing framework, where an attacker records and relays a live, authenticated browser session from a victim to an adversary-controlled server.
Detects Browser-in-the-Middle (BitM) phishing attacks, such as Bluekit, that utilize the rrweb library for real-time DOM serialization and WebSocket streaming to capture user sessions. The rule correlates the presence of the rrweb library in HTTP traffic with WebSocket communication patterns containing session handshakes and serialized DOM payloads.
Detects browser processes exhibiting a pattern consistent with 'Browser-in-the-Middle' attacks, specifically the streaming of DOM content (e.g., using rrweb) over persistent WebSocket connections to external IP addresses. The rule identifies high-density connection events to the same remote IP on port 443 lasting for more than 120 seconds and correlates these events with a preceding phishing email click on the same device.
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
This rule identifies a suspicious sequence of events: a successful device code authentication immediately followed (within one hour) by a device registration event (PRT upgrade) for the same user. This pattern is indicative of a device code phishing attack where an attacker tricks a user into authenticating a device code, then registers their own device to gain persistent access.
Detects successful sign-ins utilizing the device code flow, which is frequently abused in Adversary-in-the-Middle (AiTM) phishing attacks. This rule specifically looks for successful authentication events where the 'AuthenticationProtocol' is 'deviceCode'.
Detects fake AI installers (e.g., deepseek, ProFluxeFlowAi) making network connections before deploying a Python loader. This activity is indicative of social engineering campaigns leveraging popular AI brands to distribute malware.
Detects a .zip or .rar archive being dropped in a downloads folder, followed immediately (within 10 minutes) by the execution of a suspicious installer executable from that same path. The installer executable names are indicative of fake AI-related software (e.g., deepseek, gpt, kimi). This pattern suggests a social engineering attack where users are tricked into downloading and executing malicious software disguised as legitimate AI applications.
This rule detects suspicious DNS queries originating from VBScript (wscript.exe or cscript.exe) processes. It specifically filters out common legitimate domains like Microsoft, Windows, and Google to reduce noise, aiming to identify potential phishing or malware activity leveraging VBScript for network communication.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) where the initiating parent process is not a common legitimate process like explorer.exe, cmd.exe, powershell.exe, svchost.exe, or system.exe, and is also not a web browser (Chrome or Firefox). This pattern can indicate an attempt to execute malicious VBScript or JScript files, potentially delivered via phishing, where the script is launched by an unusual or obfuscated parent process to evade detection.
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
Identifies users accessing Cloudflare Turnstile or reCAPTCHA gateways immediately preceding the AiTM proxy domain resolution. This behavior is indicative of an adversary-in-the-middle (AiTM) phishing attack attempting to bypass CAPTCHA challenges.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects incoming phishing emails leveraging Scotiabank and Interac branding for Telephone Oriented Attack Delivery (TOAD). These emails utilize HTML attachments or body content containing specific toll-free numbers (1-800-472-6) and financial lures related to unauthorized Interac e-Transfers, aiming to deceive recipients into initiating a callback.
Detects a spear-phishing email masquerading as AWS Support services originating from a specific compromised university account (awsservices@presby.edu). This rule identifies malicious emails associated with the PoisonSeeds AiTM (Adversary-in-the-Middle) phishing campaign, which uses support ticket lures to harvest credentials.
Detects reverse proxy phishing pages designed to intercept MFA OTP codes
Identifies email attachments with a specific naming convention ('Agreement Settlement [Target] May [Day], 2026.pdf') used in a credential harvesting campaign. This rule looks for PDF files starting with 'Agreement Settlement' and ending with '.pdf', with a specific date format for May 2026.
Page 44 of 77