Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
726 detections
Filters
Last updated
All Time
Detection languages
401
142
54
54
27
Contributors
153
152
78
42
33
Categories
227
208
134
132
119
Platforms
466
226
29
29
27
Products / Services
237
212
122
48
21
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
726
CVEs
5
5
5
4
4
IDS Classtypes
7
2
IDS Protocols
6
2
1
This rule consolidates multiple detections related to a widespread malspam campaign delivering the Nova infostealer. It hunts for activity across email, network, DNS, and firewall logs associated with known malicious domains, IPs, and specific TTPs like suspicious archive attachments from impersonated brands.
Adversaries often use malicious macros embedded in Office documents (Word, Excel) to execute payloads often spawning PowerShell, cmd, or LOLBins. This rule detects macro-triggered process chains indicative of weaponized documents.
Detects DNS queries to domains that are suspiciously similar to trusted ones, which may indicate typosquatting, phishing, or user deception tactics. The detection compares unknown domains to a known safe allowlist using a fuzzy character-difference heuristic.
Detects possible prompt injection or abuse of AI models like LLMs via unusual process and API call patterns
The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
Detects the download of a Java Archive (.jar) file from common file-sharing services like Dropbox or MediaFire. This behavior is associated with sophisticated email campaigns where attackers use PDF attachments with embedded links to trick users into downloading and executing Remote Access Trojans (RATs).
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
Detects emails delivered to user inboxes that contain both a PDF attachment and a URL identified as a phishing link. This rule is designed to identify modern QR code phishing (quishing) campaigns where the malicious URL is embedded within the PDF to bypass traditional email security scanning. The detection relies on the email security solution's ability to extract and flag URLs from attachments, including those embedded in QR codes.
Detects the mounting of an ISO file, a common technique used by threat actors, including the SLOW#TEMPEST campaign, to deliver malware. ISO files can bypass some security controls and require user interaction (double-clicking) to mount, after which malicious content can be executed.
Detects a specific malicious LNK file used by the Dropping Elephant (Patchwork) APT group to deliver payloads in a campaign targeting the Turkish defense industry.
Catches MSI installer execution from browsers with silent installation flags, often used in FileFix attacks to install malware without user interaction.
Detects RDP configuration files (.rdp) that enable malicious RemoteApp features and extensive resource redirection, commonly abused in 'Rogue RDP' campaigns for espionage and data exfiltration.
This detection rule identifies the creation of ISO (.iso) files on endpoints, specifically focusing on those created by common internet browsers and email clients. This activity is associated with the SLOW#TEMPEST campaign, which is known to distribute malware payloads via ISO files, often bundled with legitimate applications and malicious DLLs. The rule aims to detect the initial delivery vector of this threat.
This search will find all inbound emails with attachments with filenames ending .lnk, indicative of a Windows Shortcut file.
This has been observed in the Serpentin#Cloud campaign
This has been observed in the Serpentin#Cloud campaign
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments.
This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
KQL Query from file: Direct Send Abuse Detection
KQL Query
KQL Query
Detection of spear-phishing emails containing a signed Remote Desktop Protocol (RDP) configuration file designed to connect to an actor-controlled server. In some cases, the threat actor attempted to enhance credibility by impersonating Microsoft employees and referencing other cloud providers in the phishing lures.dp files in Outlook temporary folders
KQL Query
Page 28 of 35