Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
Detects high-volume POST requests to login forms indicating credential harvesting
Detects mshta.exe launched from Windows Explorer to retrieve remote HTA content over HTTP, a technique frequently observed in phishing campaigns and initial access attacks.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
This rule detects potential spear phishing campaigns by identifying a high volume of emails (10 or more within an hour) from external senders (not @company.com) that contain keywords like 'password', 'account', or 'security' in the subject line, and also include either an attachment or a URL. This combination of factors suggests a targeted social engineering attempt.
This rule detects emails containing multiple obfuscated URLs from common URL shortening services (bit.ly, tinyurl, short.link) originating from external senders. It specifically looks for emails with 3 or more such URLs within a one-hour window from the same sender.
Detects successful device code flow sign-ins to the Microsoft Authentication Broker application targeting the Microsoft Graph resource, specifically when the sign-in does not originate from a trusted named location. This activity can indicate a device code phishing attempt where an attacker tricks a user into authenticating a malicious application.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
Detects successful device code authentications specifically for the Microsoft Office application (AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that do not originate from trusted named locations. This can indicate a device code phishing attempt where an attacker has tricked a user into authenticating to a malicious application.
Detects DNS queries to privnote.com, which UNC3753 uses to transmit self-destructing text containing malicious installation links to targets.
Detects the presence of 'search:' or 'search-ms:' URI schemes embedded in inbound emails. These schemes can be abused to force outbound NTLM authentication and leak Net-NTLMv2 hashes via a single link click.
This rule detects potential spear phishing campaigns by identifying a high volume of emails (10 or more within an hour) from external senders (not @company.com) that contain keywords like 'password', 'account', or 'security' in the subject line, and also include either an attachment or a URL. This combination of factors suggests a targeted social engineering attempt.
This rule detects potential phishing attempts by identifying emails with URLs that originate from outside the internal company domain (@company.com). It specifically looks for emails where the subject line contains keywords like 'click', 'confirm', or 'update', and where multiple such emails (3 or more) are sent from the same external sender to the same recipient.
Detects a successful login from a non-compliant, unmanaged device followed by an inbox rule creation or modification within 10 minutes. This sequence aligns with post-compromise evasion tactics observed in device code phishing campaigns like Kali365, where attackers quickly suppress security alerts after gaining access.
Detects network connections to the '.cfd' TLD originating from common web browsers. This cheap TLD is increasingly abused by attackers to host phishing redirect pages delivered via malicious SVG files.
Detects POST requests to pages matching credential harvesting patterns
This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.
Detects inbound emails with voicemail-themed subjects that pass SPF and DKIM but fail DMARC alignment. This technique is often used to exploit domains with p=none policies and obscure the actual origin of phishing attempts.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects potential phishing attempts by identifying emails with URLs that originate from outside the internal company domain (@company.com). It specifically looks for emails where the subject line contains keywords like 'click', 'confirm', or 'update', and where multiple such emails (3 or more) are sent from the same external sender to the same recipient.
This rule detects a multi-stage attack chain associated with the Nimbus RAT, starting with a suspicious Microsoft Teams message (vishing) from an external sender using throwaway domains (e.g., .onmicrosoft.com, .top). This initial communication is then correlated with subsequent reconnaissance activities performed via Quick Assist, where QuickAssist.exe spawns cmd.exe to execute commands like 'net time', '/domain', 'whoami', 'ipconfig', or 'systeminfo' on the victim's device within a two-hour window. The rule aims to identify the internal victim and the external sender involved in this coordinated attack.
Detects DNS resolutions for domains associated with the Kali365 affiliate panel, which is heavily abused in device code phishing campaigns. This rule specifically identifies DNS queries to known malicious domains used by this PhaaS (Phishing-as-a-Service) infrastructure.
Page 60 of 78