Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,593 detections
Filters
Last updated
All Time
Detection languages
1,146
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
505
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,593
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This query is better used in a workbook for automation.
This KQL check for email links that were clicked/ email attachment that were opened before recall
The rule detects the execution of a suspicious executable named 'sohuva_update_*.exe' from user-writable or download paths (Temp, Downloads, AppData, or ProgramData\Microsoft\MF). This execution is considered suspicious if its parent process is typically a web browser or explorer.exe, or if the parent process itself originates from one of these suspicious paths. The rule explicitly excludes legitimate executions of 'sohuva_update_*.exe' from standard 'Program Files' directories associated with Sohu installations.
The goal of this detection is to alert on activity associated with the ClickFix social engineering technique, where a user is coerced into manually executing attacker-controlled commands via the Windows Run dialog after interacting with a malicious website reached through a phishing email. More details can be found in the reference URL linked below
This rule detects a multi-stage attack chain starting with a high-confidence phishing email, followed by a risky sign-in from the recipient, and culminating in sensitive actions within Azure, specifically targeting IAM role assignments, storage account key access, or AKS cluster modifications. The detection correlates these events within a defined time window to identify potential compromise of cloud resources originating from a successful phishing attack.
This query will generate an alert for any emails that Defender AIR identifies as malicious but has taken no AIR actions.
This rule detects network connections to a predefined list of malicious domains, many of which are hosted on Vercel and appear to be associated with phishing campaigns. The domains often mimic legitimate services or financial documents, suggesting an attempt to deliver malware or steal credentials through phishing. The rule specifically looks for these domains in the 'RemoteUrl' field of 'DeviceNetworkEvents'.
There are simpler versions of this when investigating manually, this is not for manual use on your day to day activities, this is for automation.
This query detects suspicious sign-in activity from a user who has recently clicked on a phishing link. It correlates email click events with sign-in logs, identifying sign-ins from new or infrequent IP addresses after a user has interacted with a suspicious email. The rule uses configurable parameters for sender email addresses, sender domains, and subject keywords to identify phishing emails.
This rule detects suspicious process creation patterns indicative of the MuddyWater (also known as RustyWater) APT group. Specifically, it looks for Microsoft Office applications (Word, Excel, PowerPoint) launching scripting or Living Off The Land Binaries (LOLBins) such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, wscript.exe, or cscript.exe. The detection is further narrowed down by checking if these processes are created in suspicious writable paths like ProgramData, Users\Public, AppData\Roaming, or AppData\Local\Temp. Additionally, the rule includes optional enrichment for known MuddyWater/RustyWater payload names (reddit.exe, art.exe, cloud.exe, nginx.exe), persistence via the Run registry key, and the dropping of a specific staging artifact named 'CertificationKit.ini'.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things ā uniqueness, real matches, confirmed maliciousness, and activity.
šØ TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
šØ TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things ā uniqueness, real matches, confirmed maliciousness, and activity.
šØ TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
šØ TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
This rule detects inbound emails classified as phishing or malware by the email security system. It summarizes the total number of such messages, provides sample subjects, and counts how many were blocked, delivered to mailboxes, junked, or had other actions. The rule specifically focuses on emails that were delivered to a mailbox, indicating a potential bypass of initial security measures or a need for further investigation.
This query detects when a user downloads a potentially malicious or unauthorized file type (e.g., executable, script, archive) from the internet using a web browser. It leverages endpoint file creation events from data mapped to the Elastic Common Schema (ECS).
Azure Device Code OAuth Consent
Cortex XDR
This rule detects suspicious activity related to Microsoft 365 Device Code OAuth consent flows. It specifically looks for device code authentications that are single-factor or lack MFA, and then groups these by IP address and client application. The rule identifies suspicious patterns such as a high number of logins, unique users, or unique applications from a single IP address, or rapid login attempts within a short timeframe, which could indicate enumeration or phishing attempts.
Detects phishing emails containing QR codes rendered using HTML tables. This technique is used to evade image-based scanning and OCR security controls by representing the QR code as a grid of small, colored table cells (<td>) instead of a traditional image file.
Detects a ClickFix attack chain involving an email client opening a browser to a suspicious domain, followed by a file download, and subsequent execution via cmd.exe from explorer within a short timeframe. This chain of events is indicative of a social engineering attack designed to trick users into executing malicious files.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects inbound emails that appear to be Microsoft Teams invitations but contain suspicious keywords in the subject line related to financial transactions (invoice, billing, payment, renewal, charge). This could indicate a phishing attempt where adversaries leverage legitimate-looking Microsoft invitation emails to deliver financially themed lures.
This rule detects potential malicious email campaigns by identifying when multiple users submit email reports (e.g., phishing or spam) that share common entities such as sender IP, primary sender address/domain, secondary sender address/domain, or subject line. A configurable threshold determines the minimum number of distinct reports required to flag an entity as suspicious.
This Query is oriented to identify Malicious URL sent via Microsoft Teams and detect possible hits based on online Malware sites reported by the TI Feed URL Haus.
Page 54 of 76