Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,593 detections
Filters
Last updated
All Time
Detection languages
1,146
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
505
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,593
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This rule identifies users who have clicked on specific URLs that are known to be associated with phishing attempts. It correlates email URL information with URL click events to pinpoint users who interacted with malicious links shared via email. This is particularly useful for identifying victims of targeted phishing campaigns.
This rule identifies logon attempts on any device within 30 minutes of a user receiving an email categorized as malware, phishing, or spam. It correlates email event data with identity logon events to detect potential compromise scenarios where a user might interact with a malicious email and subsequently log on, possibly indicating a successful initial access or credential compromise.
This rule identifies users who clicked on URLs within emails from a specific sender. It correlates email events, URL information, and URL click events to pinpoint which users interacted with links in emails, particularly useful for tracking responses to potential phishing attempts from a compromised account.
This rule identifies inbound emails that have been delivered to the organization's email domain and are categorized as 'Phishing' by the email security system. It specifically looks for phishing indicators within the email's attachment or body. The query then summarizes the count of such emails by their URL domain, sorting them to highlight the most frequent phishing domains. The accompanying Python script demonstrates how to cross-reference these identified URL domains with VirusTotal for further analysis.
This rule detects inbound emails where the sender's domain contains "microsoft" but does not end with "microsoft.com". This is a common tactic used in phishing attacks to spoof legitimate Microsoft domains, tricking recipients into believing the email is from a trusted source.
This rule identifies and analyzes user interactions with URLs embedded in emails, specifically focusing on emails that are either inbound or intra-organizational. It determines which users clicked on URLs within these emails and provides a summary of this activity. This analysis is particularly useful in security contexts, where understanding user behavior regarding potentially risky links can help in identifying phishing attacks or other malicious activities.
This rule identifies emails originating from sender addresses listed in a GitHub-hosted CSV file, which is explicitly named 'North-Korean-Emails'. The rule's purpose is to flag incoming emails that appear to be sent from individuals or entities associated with North Korea, based on the provided list of email addresses. This could indicate potential phishing, espionage, or other malicious activities originating from North Korean threat actors.
This rule detects Tycoon and ODx AiTM phishing activity that bypasses MFA. It matches:
š¹ Network connections to known malicious domains, IP addresses, and URLs.
š¹ Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
š¹ Sign-ins originating from suspect IP addresses or user-agent strings.
š¹ Network connections to known malicious domains, IP addresses, and URLs.
š¹ Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
š¹ Sign-ins originating from suspect IP addresses or user-agent strings.
This query hunts for files shared by a specified malicious sender on user devices. It identifies if attachments from emails sent by the malicious sender have been downloaded, saved, or are present on the user's devices by joining email attachment information with device file events based on the SHA256 hash of the attachment.
Detects indicators of compromise (IOCs) and suspicious OAuth consent activity
linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft
OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft
OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
Hunts for Office 365 emails that contain URLs of popular Monero exchanges or keywords related to Monero wallet addresses. This could indicate phishing attempts, scams, or other illicit activities.
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Detects .lnk (shortcut) files launched by scripting engines (e.g., PowerShell, CMD, WScript) exhibiting suspicious traits like hidden execution, embedded commands, or admin privilege requests. Common in phishing, LOLBin abuse, and initial access.
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
This rule detects instances where an email with identified threats (e.g., malware, phishing) is received and a URL within that email is subsequently clicked by a user. It correlates email threat information with URL click events to identify successful user interaction with malicious links.
This rule detects instances where a user clicks on a URL within an email, and subsequently, the email is moved to quarantine. This sequence of events suggests that the email was initially delivered, a user interacted with a potentially malicious link, and then a post-delivery security action (quarantine) was taken, indicating a delayed detection of a threat, likely phishing or malware.
This rule detects email events that have an identified threat name and are associated with a URL click event. This combination suggests a user has clicked on a malicious link delivered via email.
This rule detects network connections, email activity, URL clicks, and Teams messages that involve domains commonly used by threat actor group Scattered Spider. It specifically looks for domains containing '-servicedesk.', '-okta.', '-sso.', '-cms.', '-helpdesk.', or 'oktalogin-'. The rule aims to identify potential phishing attempts or suspicious activity targeting SSO/helpdesk credentials by monitoring interactions with these specific domain patterns across multiple data sources.
The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
š Description
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
š Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
šÆ ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
š Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
šÆ ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
This detection identifies when a one-on-one Microsoft Teams chat is initiated with an external domain that has not been observed in previous Teams chats (past 90 days) or recent email communications (past 15 days). This may indicate a new, potentially unsolicited or suspicious contact attempting to engage with an internal user, which could represent a social engineering attempt or early-stage reconnaissance.
Page 58 of 76