Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,592 detections
Filters
Last updated
All Time
Detection languages
1,145
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
504
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,592
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
The analytic detects the creation of a DLL file by an outlook.exe process in the AppData\Local\Microsoft\FORMS directory. This activity is significant as it may indicate an attempt to exploit CVE-2024-21378, where a custom MAPI form loads a potentially malicious DLL. If confirmed malicious, this could allow an attacker to execute arbitrary code, leading to further system compromise or data exfiltration.
This analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. This capability is an enhanced protection feature that can be used within O365 tenants by administrative users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
This analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as ".exe", ".dll", or ".ps1". This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host. If confirmed malicious, this activity could lead to code execution, privilege escalation, or persistent access, posing a severe threat to the environment.
Detects and alerts on users bypassing Chrome Safe Browsing warnings and accessing potentially dangerous content or downloads
This rule detects failed authentication attempts in Okta where the security result indicates a "FastPass declined phishing attempt." This specifically targets real-time Adversary-in-the-Middle (AiTM) phishing proxy attacks against users enrolled in Okta FastPass, which is designed to prevent such attacks by checking the origin of the authentication request.
This rule detects DNS queries for domains that contain a specific string (e.g., a company name) and are not registered with an approved domain registrar. It leverages WHOIS data to identify potentially malicious typosquatting domains that have been recently registered or observed. The rule specifically looks for DNS queries where the domain name matches a defined pattern (e.g., 'threatpunter') and the WHOIS information indicates a registrar other than the approved one ('MarkMonitor Inc.'). Additionally, it checks if the domain was first seen in the environment within the last 30 days, indicating a new or suspicious registration.
Detects when an Amazon Simple Email Service (SES) configuration is modified, which could indicate an attacker attempting to propagate phishing email campaigns. This includes the creation, deletion, or verification of email identities and domains, as well as enabling sending for accounts or configuration sets.
Okta provides a platform detection for when a user enrolled in FastPass fails to authenticate via a real-time AiTM phishing proxy.
Detects the download of potentially malicious file types (executables, scripts, documents, archives, etc.) from domains using suspicious or commonly abused Top-Level Domains (TLDs). This rule aims to identify initial access attempts often associated with phishing or drive-by download campaigns.
Detects downloads of potentially malicious file types (executables, scripts, documents, archives) from domains that are not common Top-Level Domains (TLDs). This rule aims to identify suspicious file transfers that bypass typical, trusted sources.
Detects file indicators associated with a 2018 phishing campaign attributed to APT29 (Cozy Bear), as reported by Mandiant. The rule specifically looks for the creation or modification of files named 'ds7002.lnk', 'ds7002.pdf', or 'ds7002.zip'.
Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.
Detects suspicious child processes spawned by Microsoft OneNote. This rule identifies attempts to execute malicious embedded objects from a .one file by monitoring for OneNote spawning known LOLBINs (Living Off the Land Binaries) or executables from suspicious paths. This behavior is often associated with initial access and execution techniques used by adversaries.
Detects the creation of a "Report.wer" file in an uncommon folder structure, specifically outside of the typical Windows Error Reporting (WER) archive paths. This activity could indicate potential exploitation of CVE-2023-36874, where adversaries might manipulate WER to achieve execution or persistence.
Detects cases where an ISO file is opened within an archiving application like 7-Zip or WinRAR. This behavior is often associated with phishing campaigns where threat actors embed small ISO files in archives as email attachments to bypass security filters and protective measures (e.g., Mark-of-the-Web).
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Page 76 of 76