Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
Detects network traffic containing a characteristic 'Loading in progress...' string, which is associated with the 'Kratos' animated envelope loading screen used in fake Microsoft 365 credential harvesting pages.
This rule detects potential OAuth Device Code Flow phishing attacks where users are directed to malicious lure pages on romnor[.]ca to enter a Microsoft device code. It also alerts on authentication activity associated with a specific malicious OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) known to be used by a phishing backend to poll and claim OAuth tokens.
This rule detects network activity associated with a phishing campaign impersonating the RENAPO CURP lookup service. It monitors for TLS SNI and HTTP Host headers containing the typosquatted domain 'gobf.mx', as well as HTTP responses containing specific keywords related to the Mexican CURP registration form originating from this domain.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
This rule detects potential phishing attempts by identifying emails that contain links to legitimate Microsoft Forms (forms.office.com) with lures commonly associated with document-related phishing (e.g., 'shared a document', 'invoice'). The rule then correlates this with user click activity to identify instances where the user was redirected from the Microsoft Forms site to an external, potentially malicious URL.
This rule detects email activity where a user receives an email containing a link to 'tilda.ws' (often used for landing pages) with social engineering themes like invoices or document signing, and subsequently clicks the link to be redirected to a different destination. This pattern is indicative of a credential phishing or malicious landing page campaign.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Detects instances where users click links directing to Proton Drive domains, a common vector for device code phishing and credential harvesting attacks.
This rule monitors network traffic for DNS queries and HTTP requests directed toward known malicious domains associated with phishing campaigns, specifically those leveraging OAuth device code authorization flows (e.g., /devicelogin, /deviceauth) and credential harvesting sites.
Detects sequential HTTP GET requests for specific SVG assets (barr.svg followed by lg.svg) associated with the Kratos V1 phishing kit landing page, indicating potential interaction with a phishing site.
Detects inbound or intra-organizational emails that contain URLs associated with Proton Drive services. This rule is specifically designed to identify potential device code phishing attempts or malicious document distribution utilizing Proton Drive's infrastructure.
This rule identifies emails containing URLs that point to known malicious domains used in phishing campaigns. It joins email URL information with core email event details to report the sender, recipient, subject, and the specific malicious domain associated with the URL.
Detects instances where a user receives an email containing a link to 'canva.com' with subject lines suggestive of document sharing or invoicing, and subsequently clicks a URL that redirects them away from the 'canva.com' domain. This behavior is indicative of potential document-based phishing where attackers use legitimate document hosting platforms as a lure to redirect users to malicious or credential-harvesting websites.
ARTokenC2NetworkTraffic - fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Detects HTTP GET requests for specific static assets (dsa.svg, sid.gif, imag.jpg) known to be associated with the Kratos V2 phishing kit, which is often used in credential harvesting campaigns.
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Detects static HTML/JS/CSS artifacts matching the DEBULL device-code phishing template via admin.css SHA256, Composer content-hash, and Turkish-language code markers
This rule detects incoming emails containing specific subject lines related to 'Request for Payment' and 'Shared Folder' that include links to the '/Team_Meets/' path. It flags instances where the sender's domain differs from the domain hosting the embedded link, which is a common indicator of phishing or credential harvesting attempts using domain masquerading.
Detects specific URI patterns associated with the DEBULL (also known as CloakGuard) Phishing-as-a-Service (PhaaS) platform. These URI paths are commonly used by attackers managing phishing campaigns, including administrative authentication or deployment script execution on compromised infrastructure acting as a phishing panel.
Page 46 of 78