Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
This rule detects indicators of Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Evilginx2 and similar proxy frameworks. It identifies unauthorized execution of Evilginx2 binaries, the presence of specific session and configuration files (.evilginx/, phishlets, session databases), unauthorized modifications to Nginx configurations, and the dropping of suspicious HTML lure files into web document roots by scripting interpreters.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by identifying successful user sign-ins from a new, historically unseen IP address occurring within 30 minutes of a legitimate sign-in from a known IP, indicating the potential replay of a stolen session or refresh token.
Detects the execution of known adversary-in-the-middle (AiTM) phishing frameworks, such as Evilginx or Modlishka, by identifying process names, paths, or specific command-line arguments (e.g., --phishlets, --proxy, --lure) used to initiate these proxy-based phishing sessions.
Tycoon2FA PHaaS User Agent Detection
Cortex XDR
Detects user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) campaigns, specifically targeting credential relay (axios/1.13.x) and device code phishing (node/undici) variants. The rule identifies sign-in attempts from unmanaged and non-compliant devices using these specific user agents during a device code flow authentication.
This rule detects potential malvertising or drive-by download activity by identifying when common web browsers spawn script-interpreting processes (such as powershell.exe, cmd.exe, or mshta.exe) that execute suspicious commands indicative of obfuscation or payload delivery (e.g., IEX, EncodedCommand). It further correlates this activity with outbound network connections initiated by the child process within a 30-second window, which is characteristic of the second stage of a malware delivery chain.
Detects the Montana Empire Android malware, either through a direct SHA256 hash match or through structural characteristics of the APK file (such as the presence of 'post.apk') combined with specific embedded strings commonly found in the attacker's fraudulent mobile landing pages used for social proof.
This rule monitors network logs (proxy, web gateway, and DNS) to detect connections to a curated list of known malicious domains associated with phishing, credential harvesting, and malware delivery infrastructure.
This rule monitors network and email gateway logs to detect activity related to the Bluekit Phishing-as-a-Service (PhaaS) platform. It identifies traffic to known Bluekit command-and-control or phishing domains, detects the presence of rrweb scripts often associated with session recording on phishing pages, alerts on brand-impersonation phishing pages using specific keyword combinations, and flags the presence of FortiBleed campaign lures.
Detects an inbound policy-themed PDF attachment whose extracted URLs lead to a sign-in, authentication, review, or acknowledgement workflow outside the organisation. This rule specifically looks for PDF attachments in emails where the subject contains terms like 'code of conduct', 'policy', 'compliance', or 'handbook', and the extracted URLs within the PDF contain keywords such as 'login', 'signin', 'auth', 'review', or 'acknowledge'.
This rule detects email-based phishing attempts that utilize a two-hop open-redirect mechanism by abusing legitimate SaaS platforms (holabrief.com and loopedin.io). It flags emails containing specific redirect links, often used to bypass traditional security filters by redirecting users through trusted domains before reaching a malicious destination.
Detects inbound phishing emails that fail both DKIM and DMARC checks, contain invoice-themed subject lines, and include links pointing to known open-redirect infrastructure (holabrief.com or loopedin.io). This pattern is consistent with credential harvesting campaigns using multi-hop SaaS redirects.
Detects HTTP requests to the SaaS platforms 'holabrief.com' or 'loopedin.io' that contain common URL redirection parameters, characteristic of an open-redirect abuse tactic used in phishing campaigns. These platforms are leveraged as intermediate hops to obfuscate the final destination of phishing links. The rule identifies the initial request and suggests correlation with subsequent traffic to unknown destinations to confirm a two-hop redirection chain.
Detects phishing emails that spoof specific healthcare domains (nhs.uk, mayoclinic.org, clevelandclinic.org) using invoice or payment-related subjects, characterized by DMARC/DKIM/SPF authentication failures. The detection correlates these emails with a subsequent user network request to known open-redirect or intermediary SaaS platforms (holabrief.com, loopedin.io) within a 10-minute window, indicating a likely credential harvesting or malware delivery sequence.
Detects potential invoice-themed phishing campaigns by identifying inbound emails that simultaneously target multiple recipients from senders with whom the organization has no prior communication history. The detection specifically flags emails with authentication failures (DKIM, SPF, or ARC) in the subject line, which is a common pattern for phishing attacks attempting to bypass reputation filters using aged domains.
Detects a user who interacted with a code-of-conduct lure subsequently authenticating through an anonymous proxy or anonymisation service. This rule correlates URL click events or sign-in events with subjects related to 'code of conduct' or 'policy acknowledgement' and then checks if the subsequent authentication occurred via an anonymous proxy.
Detects many unique, high-entropy URL paths that each receive a small number of requests before redirecting to authentication. This behavior is indicative of adversaries like Volt Typhoon (Tycoon) using one-time session paths for each victim in phishing campaigns.
Detects a user navigating to the Microsoft devicelogin portal immediately after clicking a link from an email, a precursor to Device Code OAuth phishing.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
AI-powered phishing-as-a-service abusing device-code authentication
AI-powered phishing-as-a-service abusing device-code authentication
AI-powered phishing-as-a-service abusing device-code authentication
Page 54 of 78