Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
Detects instances where a user grants an OAuth application permissions for high-privilege scopes such as 'mail.read', 'files.readwrite', or 'offline_access'. This behavior is frequently indicative of OAuth consent phishing campaigns targeting Microsoft Entra ID environments to gain unauthorized access to user data and maintain persistence via stolen access tokens.
Detects the creation of .amazonq/mcp.json or mcp.json files within repository directories following a git clone operation. This behavior is associated with the exploitation of vulnerabilities (such as CVE-2026-12957) where attackers use malicious job-interview repositories to trigger automatic execution of arbitrary MCP (Model Context Protocol) servers in the Amazon Q Developer extension in VS Code, potentially leading to unauthorized credential or sensitive data access.
Detects incoming phishing emails sent from personal Gmail accounts that attempt to impersonate law firms by using legal-themed subjects (e.g., lawsuits, subpoenas, cease and desist). The rule specifically identifies the use of URL shorteners commonly used to obfuscate credential-harvesting destinations. The detection relies on email metadata and subject line patterns to identify potential spearphishing attempts.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects incoming emails containing suspicious legal-themed subjects (e.g., subpoenas, copyright infringement) from Gmail domains that include shortened URLs (e.g., bit.ly, goo.gl). The rule also checks for successful SPF or DKIM authentication results, which are common in mass phishing campaigns to bypass initial spam filters.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects HTTP POST requests to known phishing kit endpoints 'panel_track.php' or 'verify_api.php', which are associated with the Montana Empire credential harvesting campaign.
Detects network connections from common browser processes and script execution engines to the known Payroll Pirate (Storm-2755 / Storm-2657) phishing domain 'bluegraintours.com', which is associated with Adversary-in-the-Middle (AiTM) session cookie and OAuth token harvesting.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects web proxy traffic containing links to lookalike recruitment portals using specific typosquatting suffixes (e.g., .com.de) and URL paths (/careers/auth). These patterns are linked to UNC1549, an adversary identified as targeting aerospace and defense organizations with fake React-based recruitment lures.
This rule detects DNS queries for the domain 'teledyneflir.com.de', which is known to be used by the threat actor UNC1549 as a fake recruitment portal to conduct phishing campaigns impersonating the Teledyne FLIR careers site.
Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.
Detects phishing links delivered through Microsoft Teams or Slack messages
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
This rule detects network connections to a list of domains identified as associated with phishing activities associated with Crimson Kingsnake. Monitoring these connections can help identify compromised systems or users attempting to access malicious sites.
Detects signs of Adversary-in-the-Middle (AiTM) phishing where a login attempt produces a reprocess error (50199) or result code 90014, immediately followed by suspicious activity using specific Firefox user-agent versions known to be associated with Tycoon 2FA reverse proxy session token capture tools.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com. This indicates that the attacker's backend successfully returned 'status:completed' and the phishing kit executed a window.location.replace to redirect the victim to OneDrive after token capture.
Detects a successful authentication event (including MFA success) immediately followed by another successful authentication for the same user account from a different IP address or user agent, within a 10-minute window. This behavioral pattern is often indicative of session hijacking or adversary-in-the-middle (AiTM) phishing attacks where an attacker reuses a session token obtained from a victim.
Page 49 of 78