Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,593 detections
Filters
Last updated
All Time
Detection languages
1,146
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
505
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,593
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This rule detects potential SVG-based phishing attempts originating from Microsoft Outlook. It correlates network access, file downloads, and URL click telemetry to identify instances where Outlook initiates connections to or downloads files ending with '.svg'. This is particularly relevant for detecting phishing campaigns that leverage malicious SVG files to embed JavaScript, redirectors, or Base64-encoded HTML payloads for credential harvesting or other malicious activities.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
This query detects URLs shared in Microsoft Teams messages, chats, or meetings that may represent potential security risks. It filters out internal domains, SharePoint URLs, placeholder links, and known system domains to focus specifically on unique external URLs being exchanged within the organization.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
This rule detects various activities associated with the InterLock Ransomware (UNC5774). It identifies anti-VM checks performed via PowerShell, specifically looking for commands that query for QEMU, memory less than 4GB or 1.5GB, or specific desktop naming conventions. It also detects local group and Service Principal Name (SPN) enumeration using PowerShell cmdlets like 'Get-LocalGroupMember', 'Get-LocalGroup', or ADSI queries for 'samAccountName' and 'servicePrincipalName'. Persistence mechanisms are covered by monitoring registry Run/RunOnce keys for entries that launch 'node' or 'php' executables. Furthermore, the rule looks for suspicious staging of 'node.exe' or 'php.exe' within the AppData\Roaming directory when initiated by PowerShell processes. The rule leverages 'DeviceProcessEvents', 'DeviceRegistryEvents', and 'DeviceEvents' (specifically PowerShellCommand action type) to capture these activities.
Identifies devices with vulnerable versions of popular password manager browser extensions installed and active. These versions are susceptible to credential theft via DOM manipulation by malicious web pages. Note:
This is potential for false positives; the exploit is Client-side, out of reach for traditional detection. The detection will only validate vulnerable versions for the following password manager vendors who have not remediated all the vulnerabilities in the report by researcher Marek Tóth.
This is potential for false positives; the exploit is Client-side, out of reach for traditional detection. The detection will only validate vulnerable versions for the following password manager vendors who have not remediated all the vulnerabilities in the report by researcher Marek Tóth.
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc., and connects to a web application over http(s). This could indicate a possible phishing attempt, where a malicious document is used to redirect a user to a malicious website.
Detects potential malicious email execution chains where Microsoft Outlook spawns suspicious child processes (e.g., powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
This rule detects phishing attempts by identifying emails containing URLs and endpoint network connections to domains known to be associated with phishing campaigns. It leverages an external Indicator of Compromise (IOC) list of phishing domains. The rule scans email events for inbound messages with URLs matching these domains and also monitors endpoint network events for successful connections or HTTP inspections to these malicious domains. The results from both email and endpoint sources are then combined to provide a correlated view of potential phishing activity.
This rule detects potential malware infections and command and control activity by correlating email, endpoint file, and network events with indicators of compromise (IOCs) sourced from an external OSINT feed. It specifically looks for SHA256 hashes in email attachments, domains and URLs in email links, MD5, SHA1, and SHA256 hashes of created files on endpoints, and IP addresses and domains in network connections (both direct and HTTP inspected connections). The rule aims to identify initial access, execution, and command and control phases of an attack, potentially involving Cloudflare Tunnels as suggested by the rule's title and the OSINT source.
here we go with another quick and dirty one to detect Phishing Urls in Emails listed on phishunt.io Feed.
Recommended Action move to Junk Mail Folder or Delete the Message
Recommended Action move to Junk Mail Folder or Delete the Message
This rule correlates Microsoft Defender for Endpoint (MDE) SmartScreen and Network Protection blocks with network activity logs. It specifically looks for instances where SmartScreenUrlWarning or ExploitGuardNetworkProtectionBlocked events occur due to 'CustomBlockList' or 'CustomPolicy' settings. The rule then joins these events with DeviceNetworkEvents to identify the associated URLs, remote IP addresses, and ports involved in the blocked network communication. The primary goal is to identify and provide context for network access attempts that are blocked by custom security policies, indicating potential malicious or unwanted website access.
This rule detects emails containing URLs that match domains identified as phishing domains by cert.pl. It joins email URL information with a regularly updated list of known malicious domains from cert.pl and then correlates these with email events to identify potential phishing attempts.
This KQL query is designed to enrich "Malicious URL Click" alerts by correlating them with user sign-in activity. It finds the affected accounts and then checks if they had a successful login from a new IP address around the time of the alert. The final output flags high-risk events where a user's URL click activity is immediately followed or preceded by a login from an IP they've never used before. This helps prioritize investigation into potentially compromised accounts.
Detects scenarios where an attacker attempt to hide emails in order to perform phishing attacks by replacing, for example, financial information from the original email with another email containing attacker's financial information. This technique may also be used to avoid specific email notification to be received by end users in case, for example, of an ongoing breach.
Detects suspicious OAuth app consents, role assignments, and group changes involving Workday and Salesforce, indicating potential account compromise or privilege escalation.
This detection identifies network connections to domains that may be impersonating ConnectWise or ScreenConnect for credential harvesting purposes. The logic is based on tactics observed in the MCTO3030 campaign which used domains with specific country-code TLDs or generic "connectwise" and "screenconnect" themes.
This detection identifies suspicious use of wreply or redirect_uri parameters in ADFS or Microsoft login URLs. Attackers can abuse these parameters to redirect users to non-Microsoft domains after authentication, a technique commonly referred to as ADFSjacking.
In May 2025, a campaign started using the Microsoft Exchange Direct Send feature to send phishing mails to organizations. This feature is designed for use by printers, scanners, cloud services and other devices that need to send messages on behalf of the company. This detection rule tries to detect the malicious mails being send via Direct Send using a couple of indicators:
- Sender email is the same as Recipient email
- SPF and DMARC both failed
- Mail is not comming in via an Exchange connector
- The sender IP address country is not a country that the user is known to login from
FYI, if you remove the country check (last line of the query), you can use the query to identify if there are legitimate mails as well. If not, you can disable the Direct Send feature in Exchange Online.
- Sender email is the same as Recipient email
- SPF and DMARC both failed
- Mail is not comming in via an Exchange connector
- The sender IP address country is not a country that the user is known to login from
FYI, if you remove the country check (last line of the query), you can use the query to identify if there are legitimate mails as well. If not, you can disable the Direct Send feature in Exchange Online.
Page 57 of 76