Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,597 detections
Filters
Last updated
All Time
Detection languages
1,150
134
65
63
53
Contributors
368
274
239
197
70
Categories
982
375
271
227
140
Platforms
870
506
164
159
149
Products / Services
948
298
133
113
108
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
1,597
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects incoming emails containing hyperlinks to legitimate Microsoft device code authentication pages combined with keywords or spoofed branding for document sharing services like DocuSign, Adobe Acrobat Sign, or SharePoint. This technique is indicative of Kali365 and similar Phishing-as-a-Service (PhaaS) kits attempting to steal OAuth tokens and bypass MFA.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
Detects generic phishing pages serving credential capture forms to victims
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
Detects inbound email that fails SPF authentication indicating email spoofing
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
This rule detects potential internal phishing campaigns by identifying newly observed sender domains that send emails to a large number of internal recipients within a short period. It looks for sender domains that have been seen for the first time within the last 7 days, have sent emails to more than 10 unique recipients, and have sent more than 5 emails in total. This behavior can indicate an attacker attempting to phish internal users from a newly created or compromised domain.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
This rule identifies successful device code authentications using the Microsoft Authentication Broker application (AppId '29d9ed98-a469-4536-ade2-f981bc1d605e') targeting Microsoft Graph (ResourceIdentity '00000003-0000-0000-c000-000000000000'). It specifically looks for these authentications originating from untrusted network locations. This activity is highly anomalous and can indicate an attacker generating Primary Refresh Tokens (PRTs) via device code phishing.
This query visualises total emails with Spoof - DKIM fails summarizing the data daily.
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
This rule detects potential bulk phishing email campaigns by identifying a high volume of emails originating from external senders (not @company.com) with suspicious subject lines containing keywords like 'action required', 'verify account', or 'confirm identity'. The rule triggers if at least 50 such emails are sent to 20 or more unique recipients within a one-hour window.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
Detects DNS requests to domains matching known UNC3753 data leak sites or phishing domains masquerading as IT helpdesks, serving as an early warning of an ongoing vishing campaign or active extortion.
Detects successful device code flow sign-ins to the Microsoft Authentication Broker application targeting the Microsoft Graph resource, specifically when the sign-in does not originate from a trusted named location. This activity can indicate a device code phishing attempt where an attacker tricks a user into authenticating a malicious application.
Detects successful sign-ins to Microsoft Office applications using the device code flow (FOCI AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that originate from an untrusted network location. This activity can indicate a device code phishing attack where an adversary has tricked a user into authenticating a malicious application.
This rule detects potential phishing attempts impersonating Adobe Document Cloud. It looks for emails with subjects containing keywords like "Adobe", "Document Cloud", "Sign Document", or "View Document", but where the sender's domain is NOT a legitimate Adobe domain (adobe.com or documentcloud.adobe.com). The rule then counts these occurrences per sender address and domain over a daily period.
This rule detects potential spearphishing attempts targeting high-value individuals (CEO, CFO, IT Admin) within an organization. It looks for emails sent to these individuals with subjects commonly associated with financial phishing or social engineering lures, such as "Invoice," "Wire Transfer," "Payment," "Urgent," or "Purchase Order." The rule also checks if these emails contain attachments, which is a common vector for delivering malware or credential harvesting documents in phishing campaigns. It summarizes the attempts by sender, recipient, and day, counting the number of attempts and listing the attachments.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Page 47 of 77