Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
AI-powered phishing-as-a-service abusing device-code authentication
AI-powered phishing-as-a-service abusing device-code authentication
Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. Specifically, it looks for emails where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' but differs from 'SenderMailFromDomain' (P1 envelope), and the email was successfully delivered.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
This rule detects potential spear phishing campaigns by identifying a high volume of emails (10 or more within an hour) from external senders (not @company.com) that contain keywords like 'password', 'account', or 'security' in the subject line, and also include either an attachment or a URL. This combination of factors suggests a targeted social engineering attempt.
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
Detects inbound email patterns characteristic of the Kali365 campaigns, containing instructions and formatting that prompt users to enter a specific device code. The rule identifies emails with specific subject line keywords and URLs pointing to microsoft.com/devicelogin.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
This rule identifies phishing emails containing multiple distinct redirect hops across various cloud hosting platforms (e.g., Azure Websites, Firebase, CloudFront). It flags emails as suspicious if they contain URLs from multiple monitored cloud platforms, indicating a likely bulletproof redirect chain, and correlates these emails with click data. It elevates the severity for emails sent to privileged user accounts such as admins, executives, or finance staff.
This rule detects successful Azure AD authentication attempts originating from known hosting provider or VPS IP addresses, combined with anomalous behavior such as headless browser user agents, impossible travel, or high-risk sign-in flags. This pattern is indicative of Adversary-in-the-Middle (AiTM) phishing proxies like Evilginx or Bluekit, which attempt to bypass MFA by proxying the authentication process.
This rule detects network connections or URL clicks to a list of known malicious domains often associated with phishing or malware distribution. The rule specifically looks for connections to these domains combined with certain URL paths, or direct URL clicks to these domains.
This rule detects indicators of Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Evilginx2 and similar proxy frameworks. It identifies unauthorized execution of Evilginx2 binaries, the presence of specific session and configuration files (.evilginx/, phishlets, session databases), unauthorized modifications to Nginx configurations, and the dropping of suspicious HTML lure files into web document roots by scripting interpreters.
Detects inbound emails that fail SPF, DKIM, or DMARC authentication checks while containing keywords related to invoices or payments in the subject line, and referencing known potentially malicious SaaS URLs (holabrief.com or loopedin.io) in the body or URL fields.
Detects anomalous post-compromise activity associated with Browser-in-the-Browser (BitB) attacks or general credential theft. Specifically, it monitors for browser processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are typically used for payload delivery, and unauthorized access to browser-stored credential files (e.g., 'Login Data') by non-browser processes.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects suspicious user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) attacks, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies 'axios/1.13.x' (credential relay variant) and 'node/undici' (device code variant) user agents in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies emails containing malicious PDF attachments (e.g., 2026-0610-1.pdf) or directing users to the known phishing domain 'govtop.one', commonly used to harvest credentials or deliver malware.
This rule monitors email metadata for patterns associated with known phishing campaigns mimicking Booking.com. It looks for specific lures in email subjects, suspicious attachment filenames such as 'invite.ics', malicious domains using the .cfd TLD, or body text containing 'Download Photos and Videos'.
Detects instances where a browser or email client spawns a PowerShell process containing common obfuscated command-line arguments (e.g., -enc, IEX, bypass), which then subsequently executes node.exe or wscript.exe. This pattern is characteristic of the TONResolver infection chain, where a phishing lure triggers initial code execution via browser or email client to deploy a JavaScript-based RAT.
This rule detects potential email spoofing attempts where an email claims to originate from a specific domain ('gasparinutrition.com') or is intended for external recipients, but fails critical authentication checks. Specifically, it identifies emails with DMARC failure, SPF failure, and a suspicious DKIM signing domain associated with 'gappssmtp.com', indicating an attempt to bypass sender authentication mechanisms.
Page 52 of 78