Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
KQL Query from file: Cloudflare Eviltokens: Gotta catch’em all
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
Detects successful interactive device-code flow sign-ins through the Microsoft Authentication Broker application (Client ID 29d9ed98-a469-4536-ade2-f981bc1d605e). Tycoon 2FA operators frequently abuse this specific flow to bypass multi-factor authentication and steal session tokens.
Detects high-confidence phishing emails that were successfully delivered to user inboxes or folders instead of being quarantined, where the message is identified as first contact and not explicitly allowed through user-level safe sender/domain overrides. The query enriches the email data with URL click telemetry from UrlClickEvents, allowing visibility into whether embedded URLs were clicked or not clicked, who clicked them, and when the click occurred. This detection is intended to identify potentially malicious phishing emails that bypassed preventive controls and provide recipient-level click insight to support triage, impact assessment, and response actions.
This rule detects attempts to grant consent to OAuth applications, which could indicate an illicit consent grant attack. It specifically looks for successful operations related to consenting to applications, adding app role assignments to service principals, adding delegated permission grants, or adding OAuth2PermissionGrants within audit logs. The rule extracts details such as the target application, the user who consented, their initiating IP address, and the permissions granted.
Detects execution or download activity tied to Nimbus Manticore (UNC1549) SEO
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
This rule detects potential phishing landing pages by looking for HTTP responses that contain both 'login' and 'microsoft' in the URI, and where the HTTP host is an IP address. This combination suggests an attempt to mimic a Microsoft login page hosted on an IP address rather than a legitimate domain, which is a common tactic in phishing attacks.
Detects inbound emails containing Mailchimp click-tracking links that redirect to ActiveCampaign landing pages, a known ESP chaining technique used to obscure credential harvesters. This technique is often used in phishing campaigns to bypass email security controls.
Identifies suspicious token authorizations for the Google Chrome OAuth client. Tycoon 2FA operators frequently use this specific client and scope to proxy authentications and capture session cookies. In a complete attack sequence, this event occurs within a 1-second window alongside a login_success and a device registration event.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Detects mshta.exe launched from Windows Explorer to retrieve remote HTA content over HTTP, a technique frequently observed in phishing campaigns and initial access attacks.
Microsoft Teams External Link Phishing
Cortex XDR
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing Top-Level Domains (TLDs). The rule specifically looks for messages in one-on-one chats containing external links with TLDs commonly associated with phishing, such as '.ru', '.dev', '.xyz', and others, which could indicate Phishing-as-a-Service (PhaaS) infrastructure or device code lure paths.
Identifies potentially malicious client-side redirects or forced OAuth flows initiating from the Outlook Web Access (OWA) interface, characterized by 302 statuses and redirect parameters. This activity may indicate post-exploitation actions related to CVE-2026-42897.
Detects a temporal pattern characteristic of CVE-2026-42897 XSS exploitation: an OWA user reads a message (via Bind, OpenMessage, or similar EWS/OWA endpoints), and within 60 seconds, the same session issues a POST request to create or modify an inbox rule. This rapid succession from the same session cookie indicates programmatic action (XSS-driven JavaScript) rather than human-driven workflow. The rule correlates events by client IP and username within a 60-second window.
Kali365 PHaaS Device Code Detection
Cortex XDR
This rule detects potential device code phishing attempts by correlating a device code flow initiated from an unmanaged/non-compliant device with a suspicious user agent (e.g., 'python-requests' or '-live') and an 'unbound' signInTokenProtectionStatus, with a subsequent 'Cmsi:Cmsi' token replay event for the same user. This combination suggests a successful device code phishing attack where an adversary has obtained and is replaying a token after the victim has authenticated.
This rule detects authentication attempts to Microsoft 365 Azure AD from a list of known malicious IP addresses and CIDR ranges associated with the EvilToken phishing campaign. It specifically filters for 'Cmsi:Cmsi' request types, which are indicative of session replay signals used in device code phishing.
This rule detects DNS queries to known malicious domains associated with the Tycoon2FA phishing campaign. These domains are used for anti-bot verification during the attack chain, which typically involves hijacking Microsoft 365 accounts via device code phishing.
Tycoon2FA Known Infrastructure Detection
Cortex XDR
This rule detects suspicious sign-in attempts to Microsoft 365 accounts that originate from known Tycoon2FA infrastructure. It specifically looks for device code flow authentications from IP addresses and Autonomous System Numbers (ASNs) associated with Tycoon2FA, combined with indicators like unmanaged/non-compliant devices, specific user agent patterns (axios, node, undici), and particular application IDs, and an unbound sign-in token protection status. This combination of indicators suggests an attempt to hijack Microsoft 365 accounts using device code phishing.
Tycoon2FA PHaaS User Agent Detection
Cortex XDR
Detects user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) campaigns, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies user agents like 'axios/1.13.x' (credential relay variant) and 'node' or 'undici' (device code variant) in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
Tycoon2FA Malicious S3 Lure Access
Cortex XDR
Detects DNS queries pointing to a specific malicious AWS S3 bucket URL known to be utilized by the Tycoon2FA threat actor for hosting initial cloned Microsoft Power Pages lures. This rule identifies network activity attempting to resolve this highly specific Indicator of Compromise (IOC).
Identifies emails spoofing NIPR, NAIC, or Stripe domains with invoice-related lures that fail authentication. This rule specifically looks for emails where the sender's domain (SenderFromDomain or SenderMailFromDomain) is one of the targeted domains (nipr.com, naic.org, stripe.com), the subject contains keywords like 'invoice' or 'past due', and the email authentication details do not indicate a 'pass'. This combination suggests a phishing attempt leveraging brand impersonation and financial urgency.
This rule detects suspicious activity where a user clicks on a URL from an email and subsequently accesses a '.workers.dev' domain that contains keywords commonly associated with credential harvesting or malicious activity (e.g., 'docusign', 'onedrive', 'password_reset'). This pattern often indicates a phishing attempt where an attacker uses a Cloudflare Workers domain to host a malicious landing page.
Page 61 of 78