Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
This rule detects potential infection by fake-VPN browser extensions associated with the 'Myxa VPN' campaign by monitoring for specific file paths and filenames linked to known malicious extension IDs. Additionally, it monitors for network connections to known command-and-control IP addresses associated with this campaign.
Detects HTTP requests using JWR's e-commerce integration masquerade, where a base64-encoded 's' parameter carries harvested card data or a 'cart_data' parameter resolves to a non-Shopify checkout domain used to spoof the WebSocket C2 origin.
Identifies inbound email campaigns that deliver URLs to large numbers of recipients and groups activity by parent domain.
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
Detects Zscaler ZIA logs identified as Advanced Threat Protection events, specifically targeting URL categories like Phishing and WebSpam, or traffic classified as Advanced Security Risk. The rule aggregates these events by user to identify potential malicious activity, flagging sessions where threats were allowed as higher severity.
Correlates DNS/network requests to newly observed domains matching JWR's brand-plus-suffix generation pattern across .top/.cfd/.info/.cc TLDs, requiring multiple distinct hostnames sharing the same brand token within a short window to flag likely batch-registered phishing infrastructure.
Detects JWR phishing kit's fake loading progress-bar overlay (p-bar/_pbar with a maximal z-index) used to mask the hidden iframe's C2 negotiation while building victim trust.
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Detects inbound email lures impersonating a Microsoft Call Center voicemail notification, consistent with the Storm-2755 (Payroll Pirates) AiTM phishing campaign.
Detects HTTP requests to known Storm-2755 Payroll Pirates AiTM lookalike proxy domains that also reference Microsoft authentication infrastructure in the URI, indicating a reverse-proxy phishing kit relaying to real Microsoft login endpoints.
Detects phishing emails impersonating AI/LLM service providers that reference API keys or developer consoles and contain embedded URLs to login/signin/auth/console pages, consistent with token-jacking campaigns harvesting developer credentials.
Detects anomalous device code authentication patterns by monitoring SigninLogs for accounts utilizing the device code flow across multiple countries or with a high volume of attempts within a short timeframe. This behavior is indicative of potential device code phishing or automated authentication abuse.
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
Detects HTTP requests for fingerprinted JavaScript/CSS assets shared across UNC6671's cloned SSO and cryptocurrency vault-drainer phishing panels.
Detects DNS queries to the broader set of UNC6671/Blackfile/Pink/Falcon passkey- and SSO-themed lookalike phishing domains used across the campaign's rebrand clusters.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
Detects a single Entra ID session (SessionId) being used from two different countries within one hour at a travel velocity no physical journey could achieve. This is a signature of a stolen session/refresh token being replayed by an actor from a different location than the legitimate user.
Detects anomalous device code authentication patterns by monitoring SigninLogs for accounts utilizing the device code flow across multiple countries or with a high volume of attempts within a short timeframe. This behavior is indicative of potential device code phishing or automated authentication abuse.
Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.
This KQL identifies inbound emails that were not blocked and have subject lines commonly associated with phishing or social engineering lures along with a URL and/or attachment
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Detects Quick Assist (msra.exe/quickassist.exe) being launched on a device within a short window after the same user signed into Microsoft Teams, consistent with UNC6692's vishing tradecraft where actors impersonate internal IT support over Teams and coerce victims into granting remote access via Quick Assist to deploy the Edgecution malware suite.
Page 43 of 78