Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,631 detections
Filters
Last updated
All Time
Detection languages
1,055
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
403
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,631
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
Detects network connections to phishing domains mimicking Windows 11 download pages used to distribute infostealer malware.
This simple script detects whether a user clicked on a URL in an email message. It uses the 'UrlClickEvents' table in Sentinel to identify such interactions, as well as the 'EmailEvents' table to correlate the email message with the URL click event.
This detection identifies suspicious command-line pipelines commonly used in "ClickFix" attacks. It specifically searches for the use of 'curl' or 'wget' to download a payload that is immediately executed via a shell, often hidden within a subshell `$(...)` or piped directly to an interpreter. This "download and execute" pattern is a high-fidelity indicator of a successful ClickFix lure, where a user has been tricked into running a malicious command.
This detection identifies a command-line pattern characteristic of "ClickFix" attacks on macOS. It looks for a shell process (like zsh, bash, sh) that is spawned by a known terminal application and executes a command involving echoing a string, decoding it with 'base64 -D', and piping it into another shell for execution. This technique is used by adversaries to trick users into running malicious code, bypassing standard OS protections.
Detects incoming emails from Atlassian Jira domains (atlassian.net) that contain suspicious link redirectors or known Traffic Distribution Systems (TDS) like Keitaro. This activity is associated with a campaign where threat actors abuse Jira's trusted domain to send spam and phishing emails.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
Detects incoming emails from Atlassian Jira Cloud subdomains where the subject line matches known spam patterns used in a campaign abusing the service's reputation.
Domains that introduce substitutions, extra characters, or randomness (e.g., micr0soft, paypa1-secure) tend to have higher entropy than the original brand name. This increase in entropy is a useful signal for detecting typosquatting and brand impersonation attempts in phishing campaigns.
Detects DNS queries for subdomains that match a specific pattern used by the threat actor GS7. The actor uses a semi-automated infrastructure with highly specific subdomain naming conventions, such as 'rss.[random]-auth.com' or 'cpcalendars.[random]-verify.online', to host phishing pages and payloads.
This rule detects emails delivered to an inbox that contain URLs identified as malicious by OpenPhish, indicating a successful phishing attempt or delivery of a known malicious link.
Detects a sequence of macOS system profiling and software update commands associated with the UNC1069 'ClickFix' social engineering ruse, often followed by a payload download via curl piped to a shell.
This rule detects instances where users click on URLs from emails that impersonate 'DocMagic'. It specifically looks for emails with 'docmagic' in the sender display name or address, extracts URLs from these emails, and then identifies if any of these URLs were subsequently clicked by users. This indicates a potential successful phishing attempt related to the DocMagic impersonation campaign.
Detects browser processes making direct network connections to known Large Language Model (LLM) API endpoints. This activity is unusual when originating from general user web browsing, as it may indicate a malicious website is using an LLM to dynamically generate and fetch malicious code (e.g., JavaScript for a phishing page) at runtime.
Detects a browser visiting a URL with phishing-related keywords, followed by a direct network connection to a known Large Language Model (LLM) API endpoint from the same device within a short time window. This correlated behavior is a strong indicator of the "runtime assembly" attack pattern, where a malicious page dynamically generates a phishing payload by calling an LLM service.
ET PHISHING Microsoft ClickFix Landing Domain
ET PHISHING Microsoft ClickFix Landing Domain
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
Detects network connections to the typosquatted domain nexsnield.com, which is used by the malicious uBlock Origin Lite extension to track installations and correlate activity.
This attack starts when a user clicks a link in an email or message. The link opens what looks like a document, such as a purchase order or PDF. In reality, it is a fake file that runs a script when opened. The script then loads the malware. The activity is started from the browser or file explorer, which is normal for a user opening a file. But the combination of opening a document and then immediately running a script is suspicious. Legitimate documents do not run scripts when you open them. Security teams should look for cases where a user opens a file from a link and that file starts a script process. This rule helps catch that first step of the attack.
In this attack, malware is delivered through links or cloud storage. The attacker uses specific websites and services to host the fake documents. When a user clicks a link in a phishing email, they may be taken to one of these sites. The sites can look legitimate because they use well-known web infrastructure. But they are known to host the fake documents used in this campaign. Security teams should monitor for connections to these domains and URLs. Blocking or alerting on them can stop the attack before the user downloads the malicious file. This rule helps identify when a device is connecting to these known bad locations. Early detection allows teams to warn users or block the connection.
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
Page 65 of 78