Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
This rule detects potential phishing activity by correlating emails containing links to a specific suspicious domain and path with network activity (DNS queries or direct network connections) to the same domain. It targets both the initial email delivery and subsequent user interaction (e.g., clicking the link or downloading files).
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
Detects OAuth consent grants or permission additions in Microsoft Entra ID (Azure AD) audit logs that occur in conjunction with device login flow artifacts. This pattern is indicative of 'ConsentFix' or device code phishing attacks, where users are manipulated into authorizing malicious applications, potentially bypassing MFA requirements by using the device code flow.
Detects the ClickFix kill chain where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command shell or utility (cmd.exe, powershell.exe, mshta.exe) to execute a download cradle or deploy known payloads like NetSupport RAT. This behavior is typically associated with malicious CAPTCHA prompts that deceive users into pasting and executing commands via the Windows Run dialog.
Detects incoming emails where a single URL contains indicators of two or more distinct security vendor rewriting services. This technique is used by adversaries to create multi-layered redirect chains to bypass automated scanners and deliver malicious content, as seen in Tycoon2FA and Sneaky2FA campaigns.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
Detects successful OAuth device code authentication flows targeted at sensitive Microsoft cloud resources (Exchange Online, SharePoint, Teams, Graph) originating from unmanaged or non-compliant devices. This pattern is often indicative of consent phishing or device code phishing attacks where an adversary obtains a device token to gain long-term unauthorized access to user data.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
This rule detects a multi-stage phishing campaign involving Gmail-hosted emails containing 'short.gy' URLs. It monitors for three distinct signals: (1) Outbound network connections to 'chongdaotang.net', (2) User clicks on 'short.gy' links arriving from Gmail addresses, and (3) Inbound or BCC-delivered emails from Gmail senders containing 'short.gy' links. This combination is highly indicative of a phishing operation attempting to redirect users to a malicious infrastructure.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
Detects the SearchLeak (CVE-2026-42824) delivery vector where a phishing link containing a long encoded 'q' parameter targeting Microsoft 365 Copilot Search is delivered via email to trigger prompt injection and subsequent data exfiltration of sensitive information.
Detects spearphishing attempts using SearchLeak (CVE-2026-42824) which involves delivering malicious Microsoft 365 Copilot Enterprise search URLs. These URLs utilize prompt injection via the query parameter to target high-value users, aiming to exfiltrate sensitive data such as MFA codes, email contents, or meeting details through the Copilot interface.
This rule detects potential phishing activity by monitoring for the creation of specific PDF files matching common financial-themed lures and network connections to a known malicious domain 'facture-in.pages.dev'. It tracks file-based lure indicators on local devices and network requests to identify potential initial access or delivery stages of an attack.
Detects browser processes (Chrome, Edge, Firefox, IE) being launched with a URL containing a crafted Microsoft 365 Copilot Search parameter (q=) with an unusually long command line. This pattern is indicative of potential exploitation attempts such as CVE-2026-42824 (SearchLeak), where attackers inject malicious payloads or HTML/script tags into the search query string to be processed by the browser.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
Detects incoming emails where a single URL contains indicators of two or more distinct security vendor rewriting services. This technique is used by adversaries to create multi-layered redirect chains to bypass automated scanners and deliver malicious content, as seen in Tycoon2FA and Sneaky2FA campaigns.
This rule detects emails containing multiple obfuscated URLs from common URL shortening services (bit.ly, tinyurl, short.link) originating from external senders. It specifically looks for emails with 3 or more such URLs within a one-hour window from the same sender.
This rule detects potential phishing attempts by identifying emails with URLs that originate from outside the internal company domain (@company.com). It specifically looks for emails where the subject line contains keywords like 'click', 'confirm', or 'update', and where multiple such emails (3 or more) are sent from the same external sender to the same recipient.
Detects Microsoft Device Code grant type authentications in Entra ID sign-in logs, consistent with the EvilTokens phishing kit abusing the OAuth device code flow to steal tokens without capturing passwords. Flags DeviceCode protocol sign-ins from browser-based clients, which is atypical for legitimate device code usage.
Page 48 of 78