Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,593 detections
Filters
Last updated
All Time
Detection languages
1,146
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
505
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,593
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects anomalous Okta sign-on policy evaluations originating from Cloudflare, which could indicate an Adversary-in-the-Middle (AiTM) phishing attempt. The associated campaign uses Cloudflare to host its phishing infrastructure.
This KQL Query helps to understand all the URL Redirections from URLs received by Email using the UrlChainId identifier on KQL that groups together all URLs that belong to the same “click/redirect chain”. When an message contains a URL, that URL may redirect through several intermediate URLs (trackers, shorteners, phishing, etc.) before land on the final site. KQL builds a URL chain from the original URL in the email through each redirect hop. All URLs that are part of a single chain share the same UrlChainId and for each hop. On the other hand, UrlChainPosition register the position of every URL, the original one = value 0 and the other redirections tagged with next numbers(1, 2, etc. ) The following query includes different options to classify the insights into four categories:
Tracking Domains
Redirecting to Different Countries
Redirecting to Different Domains
Number of Redirections
Tracking Domains
Redirecting to Different Countries
Redirecting to Different Domains
Number of Redirections
This detection identifies emails linked to a recent widespread phishing campaign that abuses trusted Microsoft SharePoint links to bypass traditional security controls. Attackers use convincing business emails containing SharePoint URLs that lead to multi-step validation pages, mimicking legitimate Microsoft authentication flows. These techniques make the attacks highly deceptive and harder to detect, as the initial links appear legitimate.
This campaign has been active and prevalent over the past two weeks, targeting multiple organizations and leveraging user trust in Microsoft services to harvest credentials.
Use this query to find potential malicious SharePoint links in email messages and investigate them further by detonating the URLs in a sandbox environment to analyze their behavior.
This campaign has been active and prevalent over the past two weeks, targeting multiple organizations and leveraging user trust in Microsoft services to harvest credentials.
Use this query to find potential malicious SharePoint links in email messages and investigate them further by detonating the URLs in a sandbox environment to analyze their behavior.
Detects network traffic to domains associated with the TAG-160 cluster's phishing campaigns, which primarily target the logistics sector.
This rule detects network connections to or DNS requests for known malicious IP addresses and domains associated with phishing campaigns. The domains often mimic legitimate services like Zoom, Microsoft, and Google, indicating potential credential harvesting or malware distribution attempts.
This detection looks for browser network traffic to URLs containing common social engineering keywords and common web page file extensions, while excluding trusted domains. This activity is associated with the Matrix Push C2 framework, which uses malicious browser notifications to lure users to phishing pages.
This rule detects when a domain or URL observed in Teams Messages matches a known threat intelligence indicator from Microsoft Defender Threat Intelligence. It specifically looks for hits against 'Domain' and 'URL' type indicators.
Detects network connections to domains known to be used as infrastructure for an ongoing, highly evasive Evilginx phishing campaign targeting SSO portals.
Detects network connections to dedicated IP addresses previously used to host Evilginx phishing proxies. While the threat actor has reportedly shifted to using Cloudflare, these IPs represent past infrastructure and should be monitored for potential reuse.
The .cfd Top-Level Domain (TLD) is often linked to malicious activities such as phishing, malware distribution, and command-and-control (C2) operations. This query detects new allowed network connections to .cfd domains that have appeared for the first time in your environment within the past 24 hours. Monitoring these connections can serve as an early warning sign of potential security breaches or users being targeted by phishing attacks. The query also provides valuable context for each newly observed domain, including its first-ever occurrence within a 30-day window, the total recent access count, and the users involved—enabling analysts to quickly evaluate the associated risk.
This rule detects potential Browser-in-the-Browser (BITB) phishing attacks, specifically targeting the 'Sneaky2FA' technique. It looks for HTTP responses containing an iframe, base64 encoded image data, and the string ';base64,', which are indicators of a malicious page attempting to mimic a legitimate login portal within an iframe to steal credentials.
Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.
Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.
Detects emails containing URLs with patterns characteristic of the Tycoon 2FA phishing kit. These URLs often contain a base64-encoded email address in the path, preceded by a special character.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detect when System Manager successfully executes commands against an instance.
This query focuses on detecting the Brazilian banking trojan known as Maverick. This malware has recently gained attention due to its aggressive propagation methods, particularly through WhatsApp Web. By leveraging social engineering techniques, Maverick spreads malicious links and attachments disguised as legitimate messages, tricking users into executing harmful code. Once installed, the trojan is capable of intercepting banking credentials, manipulating transactions, and exfiltrating sensitive financial information. Detecting Maverick requires monitoring suspicious script executions, abnormal network traffic patterns, and unauthorized use of processes such as cscript.exe and wscript.exe, which are often abused by attackers to run malicious payloads. The query aims to identify indicators of compromise associated with Maverick’s activity, helping security teams mitigate its impact and protect users from financial fraud
This rule detects TLS connections to domains associated with Gh0st RAT impersonation campaigns, specifically 'Campaign Trio' and 'Campaign Chorus'. It looks for specific strings ('i4tools', 'youdao', 'deepseek') in the TLS Server Name Indication (SNI) field, combined with top-level domains like '.top' or '.vip'. This pattern indicates potential command and control (C2) communication from Gh0st RAT malware.
This rule detects network connections to external hosts exhibiting a specific JARM fingerprint (27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6) that has been associated with a phishing campaign, specifically targeting Harbor Freight. JARM fingerprints are used to identify unique TLS server configurations, and this particular hash indicates a known malicious infrastructure.
Thu rule focus in identity suspicious powershell commands execuded from the the windows "EXECUTE" box (WIN+R)
This rule detects emails or URL click events containing a specific pattern associated with 'quantum.php' within the URL. This pattern is often indicative of phishing attempts, particularly those designed to harvest credentials or deliver malware.
Page 55 of 76