Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
Detects HTTP POST requests containing 'poll_auth_broker_token' and 'device_code' parameters, which are characteristic of malicious OAuth 2.0 device authorization grant flows commonly used in phishing campaigns.
This rule detects HTTP POST requests to known phishing domains (frenksv.sbs, debull.app) which include specific parameters indicative of an attempt to initiate the OAuth 2.0 device authorization grant flow ('get_auth_broker_device_code'). This pattern is associated with phishing campaigns aiming to hijack a user's session by tricking them into authorizing a malicious application, eventually leading to the theft of application access tokens.
Detects inbound emails with document-related subjects that contain links to the systeme.io platform, which are subsequently clicked and redirected to a different destination. This pattern is commonly used in phishing campaigns to bypass initial security inspection by leveraging reputable hosting platforms as a redirector.
Detects an authentication event using the OAuth 2.0 Device Code grant flow, immediately followed by rapid access to multiple high-value cloud resources. This pattern is characteristic of consent phishing or device code phishing, where an adversary tricks a user into authorizing a malicious application, subsequently using that application's access token to programmatically enumerate or exfiltrate data from various services.
Detects spearphishing emails that contain both a link to the legitimate 'microsoft.com/devicelogin' page and the phrase 'device code'. This is a common social engineering tactic used to trick users into providing a device authorization code to an attacker, enabling them to bypass MFA and hijack user sessions via OAuth device code flow.
Detects incoming emails identified as phishing attempts by matching specific sender addresses, subjects related to freight/logistics, or embedded URLs and keywords associated with the 'signindat.com' domain.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
This rule detects potentially malicious email activity that uses recruitment or career-related pretexts to target specific organizations (Boeing, Airbus, Teledyne FLIR). The detection looks for combinations of career-themed keywords in the subject or body of an email that also contain an archive file attachment (e.g., .zip, .rar, .7z) or links, which is a common tactic for delivering malware under the guise of job applications.
KQL Query from file: The Hunt for QR Phisher
Detects inbound emails from external domains that contain both the recipient's job title and their company name in the subject or body, which is a common indicator of targeted spearphishing attacks (BEC/Whaling).
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
This rule detects rapid sequential DNS queries by a single host for multiple domains that mirror common brand impersonation patterns (e.g., login, business, empresas, post-app). The detection logic flags when at least two unique domains matching these patterns are queried within an 18-minute window, which is indicative of potential credential harvesting or phishing reconnaissance.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Detects connections to domains associated with the Montana Empire phishing kit, which leverages AI-hallucinated postal service domains for credential harvesting. This kit targets phantom domains identified through LLM hallucination prediction and exploits AI-generated domain suggestions.
Detects connections to AI-hallucinated API endpoints commonly generated by coding assistants. These phantom domains are weaponized by adversaries to intercept CI/CD pipeline telemetry, build notifications, and developer authentication tokens from automated systems.
This rule monitors for potential lateral phishing activity within an organization by identifying internal accounts sending high volumes of emails, correlating this with MailItemsAccessed audit events from unexpected IPs, and detecting OAuth token abuse patterns (such as granting consent or adding credentials) within the Exchange Online environment.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Detects spear-phishing emails associated with UNC1549, utilizing malicious career-themed lures. The rule identifies emails containing specific lookalike domain patterns related to Boeing, Airbus, or Teledyne FLIR, and correlates these with common recruitment-themed email subjects, HR-spoofing sender strings, or the presence of common compressed file attachments (ZIP, RAR, 7Z, ISO).
Page 47 of 78