Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
This rule detects potential AI-obfuscated phishing attempts by correlating the launch of a local HTML file (likely from an email attachment or download) with immediate network connections to highly randomized or AI-generated subdomains. These subdomains are often used to host Adversary-in-The-Middle (AiTM) proxies or credential POST endpoints in sophisticated phishing campaigns.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
Detects successful user authentications originating from known EvilToken infrastructure hosted on HZ Hosting. This activity is indicative of potential credential compromise or phishing attacks leveraging this specific infrastructure.
Detects Google Workspace OAuth authorizations requesting the Chrome native client ID, which has been observed to be used by threat actors like Tycoon 2FA to mint tokens for illicit access.
Detects successful user authentications originating from IP addresses associated with known EvilToken infrastructure hosted on Railway.com. This indicates potential compromise of user accounts via phishing or other credential access techniques, where the adversary is using their infrastructure to authenticate.
Detects inbound emails containing links to the Upflow.io billing portal that include an embedded token parameter. This technique is actively abused by attackers to grant unauthorized viewing access to fraudulent invoices without requiring login credentials.
This rule detects email events where the sender's domain fails basic DNS resolution, indicating it might be non-existent or invalid, but the email successfully bypasses authentication due to SPF macros. This could be an attempt to spoof emails from non-existent domains while still appearing legitimate to email authentication checks.
Detects a click originating from a legitimate email or marketing redirection service and ending on a page that requests enterprise credentials. This behavior is indicative of a phishing attempt where an adversary leverages trusted email services to redirect users to a credential harvesting site.
Detects successful user authentications originating from known malicious IP addresses associated with EvilToken infrastructure hosted on Railway.com. This indicates potential compromise via phishing or other credential theft methods.
Detects a user interrupt error (50199) followed by a successful authentication within 5 minutes, a pattern observed in device code phishing attacks. This rule specifically looks for sign-in logs where both error code 0 (success) and 50199 (user interrupt) occur for the same user and correlation ID within a 5-minute window.
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
Identifies outbound network connections to the Microsoft Device Code authentication endpoint, which may indicate phishing attempts (e.g., via PhaaS kits like Kali365).
Monitors for device code authentication via uncommon Family of Client IDs (FOCI) applications. This rule identifies successful device code authentications where the application ID (AppId) has been observed fewer than 5 times, indicating potentially rare or newly introduced applications. This could be indicative of an adversary attempting to use a malicious application for device code phishing.
Detects phishing links delivered through URL shortening services
This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.
This rule detects emails containing URLs associated with known phishing kits or malicious domains. It specifically looks for a predefined list of domains commonly used in phishing campaigns targeting various services like Office 365, Teams, Microsoft, Apple, Amazon, PayPal, Google, Adobe, DocuSign, and Zoom.
Identifies HTTP requests containing the custom 'X-Antibot-Token' header used by the EvilTokens phishing kit to validate interactions and evade automated scanners. This header is highly specific to the EvilTokens PhaaS and its presence indicates malicious activity.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Page 58 of 78