Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,597 detections
Filters
Last updated
All Time
Detection languages
1,150
134
65
63
53
Contributors
368
274
239
197
70
Categories
982
375
271
227
140
Platforms
870
506
164
159
149
Products / Services
948
298
133
113
108
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
1,597
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects DNS resolutions for domains associated with the Kali365 affiliate panel, which is heavily abused in device code phishing campaigns. This rule specifically identifies DNS queries to known malicious domains used by this PhaaS (Phishing-as-a-Service) infrastructure.
KQL Query from file: Cloudflare Eviltokens: Gotta catch’em all
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
Detects high-confidence phishing emails that were successfully delivered to user inboxes or folders instead of being quarantined, where the message is identified as first contact and not explicitly allowed through user-level safe sender/domain overrides. The query enriches the email data with URL click telemetry from UrlClickEvents, allowing visibility into whether embedded URLs were clicked or not clicked, who clicked them, and when the click occurred. This detection is intended to identify potentially malicious phishing emails that bypassed preventive controls and provide recipient-level click insight to support triage, impact assessment, and response actions.
This rule detects potential internal phishing campaigns by identifying newly observed sender domains that send emails to a large number of internal recipients within a short period. It looks for sender domains that have been seen for the first time within the last 7 days, have sent emails to more than 10 unique recipients, and have sent more than 5 emails in total. This behavior can indicate an attacker attempting to phish internal users from a newly created or compromised domain.
This rule detects potential phishing attempts impersonating Adobe Document Cloud. It looks for emails with subjects containing keywords like "Adobe", "Document Cloud", "Sign Document", or "View Document", but where the sender's domain is NOT a legitimate Adobe domain (adobe.com or documentcloud.adobe.com). The rule then counts these occurrences per sender address and domain over a daily period.
MFA OTP Phishing Page Detected
Suricata
This rule detects potential MFA OTP phishing pages by inspecting HTTP URIs for the presence of both 'verify' and 'otp' keywords, case-insensitively. This combination in a URI is indicative of a page designed to trick users into submitting their One-Time Passwords (OTPs) for multi-factor authentication.
This rule detects inbound emails that appear to be Microsoft Teams invitations but contain suspicious keywords in the subject line related to financial transactions (invoice, billing, payment, renewal, charge). This could indicate a phishing attempt where adversaries leverage legitimate-looking Microsoft invitation emails to deliver financially themed lures.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
This rule detects potential 'reply-all' storm attacks or malicious mass emails sent to large distribution lists within the organization. It identifies emails sent to 50 or more recipients where the subject line contains phrases like 'reply all' or 'all members', originating from an internal company domain. The rule then counts such broadcast emails within one-hour bins to identify unusual activity.
This rule detects potential spearphishing attempts targeting high-value individuals (CEO, CFO, IT Admin) within an organization. It looks for emails sent to these individuals with subjects commonly associated with financial phishing or social engineering lures, such as "Invoice," "Wire Transfer," "Payment," "Urgent," or "Purchase Order." The rule also checks if these emails contain attachments, which is a common vector for delivering malware or credential harvesting documents in phishing campaigns. It summarizes the attempts by sender, recipient, and day, counting the number of attempts and listing the attachments.
Microsoft Teams External Link Phishing
Cortex XDR
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing Top-Level Domains (TLDs). The rule specifically looks for messages in one-on-one chats containing external links with TLDs commonly associated with phishing, such as '.ru', '.dev', '.xyz', and others, which could indicate Phishing-as-a-Service (PhaaS) infrastructure or device code lure paths.
This detection identifies suspicious child process execution spawned from Notepad++ (notepad++.exe), which may indicate exploitation attempts related to CVE-2026-48778 and CVE-2026-48800. These vulnerabilities involve potential arbitrary code execution through malicious manipulation of Notepad++ configuration (config.xml) and shortcut (shortcuts.xml) files.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
This rule detects emails with subjects related to financial transactions (Invoice, Purchase Order, PO, Payment, Order) that contain attachments with suspicious file extensions (.js, .hta, .vbs). It specifically filters for emails originating from domains not whitelisted as trusted and aggregates the count and average size of such attachments.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
This rule detects authentication attempts to Microsoft 365 Azure AD from a list of known malicious IP addresses and CIDR ranges associated with the EvilToken phishing campaign. It specifically filters for 'Cmsi:Cmsi' request types, which are indicative of session replay signals used in device code phishing.
This rule detects DNS queries to known malicious domains associated with the Tycoon2FA phishing campaign. These domains are used for anti-bot verification during the attack chain, which typically involves hijacking Microsoft 365 accounts via device code phishing.
Tycoon2FA Domain Network Traffic
Cortex XDR
Detects DNS queries or network connections resolving to known Tycoon2FA credential harvesting, kill switch, and link management domains post-takedown. This rule specifically targets precise indicators of compromise (IoCs) associated with the rebuilt Tycoon2FA infrastructure.
Detects AiTM compromise where user click phishing URL, completed MFA, and signed in from a different IP within 10 minutes
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
Huntress has observed Tiflux being used in attacks that aim to establish persistence, transmit screenshots, and run commands to collect system profiling information.
Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
Page 49 of 77