Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
Detects rapid outbound meeting-invite fan-out from a Telegram account to numerous contacts (RecipientCount >= 10), excluding accounts flagged as known legitimate bulk-messaging/bot accounts, consistent with BlueNoroff's GhostCall self-propagation pipeline where compromised trusted-contact accounts distribute fake meeting invites. This rule captures only the fan-out behavior; for full GhostCall self-propagation confirmation it should ideally be paired with a companion rule detecting Telegram session reuse on a new device/IP (same UserId, within approximately 15 minutes), since that temporal join between session hijack and invite fan-out cannot be expressed as a single Sigma query.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
BlueNoroff ClickFix typosquatted meeting domain contacted (TLS SNI)
Detects network requests to the Google OAuth device authorization flow endpoint, which is commonly abused in phishing campaigns to trick users into authorizing a malicious application on their behalf, allowing an attacker to steal session tokens.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
Detects a Telegram account session being authorized from a new device/IP, which BlueNoroff has been observed abusing as the precursor step in the GhostCall self-propagation pipeline: operators reuse stolen/hijacked Telegram session cookies from a new device or IP, then use the hijacked session to send fake meeting invites to trusted contacts, enabling cyclical propagation to subsequent victims.
This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. It monitors for suspicious network connections to known Evilginx-style subdomains (e.g., owa, sso, secure, billing) that proxy traffic to login.microsoftonline.com, followed immediately by a successful user login event on the same host. This pattern indicates an active session hijacking attempt designed to capture session cookies like ESTSAUTH and ESTSAUTHPERSISTENT.
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Detects network requests to the Google OAuth device authorization flow endpoint, which is commonly abused in phishing campaigns to trick users into authorizing a malicious application on their behalf, allowing an attacker to steal session tokens.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
Detects high-confidence BoryptGrab-lineage infostealer activity involving fake GitHub delivery indicators, known C2 infrastructure, suspicious gup.exe execution, libcurl.dll side-loading from user-writable paths, and known malicious file hashes.
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Detects execution or download activity tied to Nimbus Manticore (UNC1549) SEO
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
Detects instances where a user receives an email containing a link to SharePoint or OneDrive, but upon clicking the link, the user is redirected to a different, non-Microsoft domain. This behavior is indicative of a phishing attempt using legitimate file-sharing services to bypass initial URL filtering.
This rule detects scenarios where an email containing a specific URL has been soft or hard deleted from a user's mailbox (often by security automated systems), but a user has subsequently clicked that same URL. This often indicates a race condition or a failure in security controls where a malicious link was delivered and accessed before or during the removal process.
Page 45 of 78