Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,597 detections
Filters
Last updated
All Time
Detection languages
1,150
134
65
63
53
Contributors
368
274
239
197
70
Categories
982
375
271
227
140
Platforms
870
506
164
159
149
Products / Services
948
298
133
113
108
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
1,597
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects pages impersonating IT support staff for social engineering attacks
Detects anomalous script interpreters referencing CredUIPromptForWindowsCredentialsW to spoof password prompts. This function is typically used to display a credential prompt to the user. Its presence in the command line of scripting tools like PowerShell, cmd, or Python suggests an attempt to spoof legitimate credential prompts, potentially for phishing or credential harvesting.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
Detects successful user authentications originating from known EvilToken infrastructure hosted on HZ Hosting. This activity is indicative of potential credential compromise or phishing attacks leveraging this specific infrastructure.
Detects successful user authentications originating from IP addresses associated with known EvilToken infrastructure hosted on Railway.com. This indicates potential compromise of user accounts via phishing or other credential access techniques, where the adversary is using their infrastructure to authenticate.
Detects device code authentication via Microsoft Authentication Broker targeting Microsoft Graph, which is a known indicator of Adversary-in-the-Middle (AiTM) attacks or device code phishing.
This rule detects the creation of Electron application files (electron.exe, app.asar, index.js, package.json) in unusual AppData\Local subdirectories by processes identified as UtilifySetup or Inno Setup. It leverages causality information to link the file creation to the installer process, aiming to identify potentially malicious Electron-based applications installed by suspicious installers.
This rule detects when common document-handling applications (such as Microsoft Office suite or PDF readers) spawn known remote access and support tools. This behavior is highly indicative of vishing-based social engineering attacks, where a user is tricked into downloading and executing a remote management tool via a malicious document.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects inbound email events that impersonate Scotiabank, contain financial urgency lures related to Interac e-Transfers, and include suspicious HTML attachments or .eml files. The rule specifically looks for HTML attachments or .eml files with specific naming conventions ('v-mail_' prefix or '.mp3.eml' suffix) and a file size between 7KB and 8KB, or any HTML attachment. It also checks for sender display name impersonation of Scotiabank while the sender's actual domain is not scotiabank.com.
Detects a click originating from a legitimate email or marketing redirection service and ending on a page that requests enterprise credentials. This behavior is indicative of a phishing attempt where an adversary leverages trusted email services to redirect users to a credential harvesting site.
Detects successful user authentications originating from known malicious IP addresses associated with EvilToken infrastructure hosted on Railway.com. This indicates potential compromise via phishing or other credential theft methods.
Detects a user interrupt error (50199) followed by a successful authentication within 5 minutes, a pattern observed in device code phishing attacks. This rule specifically looks for sign-in logs where both error code 0 (success) and 50199 (user interrupt) occur for the same user and correlation ID within a 5-minute window.
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
This rule detects the creation of executable or script files (e.g., .exe, .dll, .ps1, .bat, .cmd) by wscript.exe or cscript.exe within common user-writable directories such as AppData, Temp, Downloads, Documents, or Music. This activity can be indicative of malicious VBScript execution attempting to drop and execute secondary payloads, often associated with phishing campaigns.
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
Identifies outbound network connections to the Microsoft Device Code authentication endpoint, which may indicate phishing attempts (e.g., via PhaaS kits like Kali365).
Detects if multiple different fake AI installers (e.g., DeepSeek and Kimi) are executed on the same machine, indicating a concentrated phishing delivery.
Detects phishing links delivered through URL shortening services
Page 45 of 77