Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,632 detections
Filters
Last updated
All Time
Detection languages
1,056
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
404
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,632
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
This KQL check for email links that were clicked/ email attachment that were opened before recall
Detects emails containing threat-actor lure links to trojanized ScreenConnect MSI files, specifically targeting 'cld.pt' downloads with 'COMPROBANTE*.msi' patterns. The rule also looks for 'COMPROBANTE' keywords in email subjects as a fallback.
This rule detects a multi-stage attack chain starting with a high-confidence phishing email, followed by a risky sign-in from the recipient, and culminating in sensitive actions within Azure, specifically targeting IAM role assignments, storage account key access, or AKS cluster modifications. The detection correlates these events within a defined time window to identify potential compromise of cloud resources originating from a successful phishing attack.
This rule detects network connections to a predefined list of malicious domains, many of which are hosted on Vercel and appear to be associated with phishing campaigns. The domains often mimic legitimate services or financial documents, suggesting an attempt to deliver malware or steal credentials through phishing. The rule specifically looks for these domains in the 'RemoteUrl' field of 'DeviceNetworkEvents'.
This simple query helps detect whether a user interacted with the URL within the email message or not.
This query detects suspicious sign-in activity from a user who has recently clicked on a phishing link. It correlates email click events with sign-in logs, identifying sign-ins from new or infrequent IP addresses after a user has interacted with a suspicious email. The rule uses configurable parameters for sender email addresses, sender domains, and subject keywords to identify phishing emails.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
Detects commands accessing a remote WebDAV share hosted on a trycloudflare.com domain. This technique has been observed in AsyncRAT campaigns where a malicious Internet Shortcut (.url) file initiates the connection to download and execute further payloads.
Detects suspicious commands written to the Windows RunMRU registry key, which stores the history of commands executed via the Windows Run dialog (Win+R). This activity is often associated with the "ClickFix" social engineering technique, where users are tricked into pasting and running malicious commands. The rule identifies various suspicious indicators, including fake verification messages, PowerShell commands with obfuscation or download cradles, mshta, wscript, curl, wget, rundll32, bitsadmin, ssh proxy abuse, and obfuscated command line arguments.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Azure Device Code OAuth Consent
Cortex XDR
This rule detects suspicious activity related to Microsoft 365 Device Code OAuth consent flows. It specifically looks for device code authentications that are single-factor or lack MFA, and then groups these by IP address and client application. The rule identifies suspicious patterns such as a high number of logins, unique users, or unique applications from a single IP address, or rapid login attempts within a short timeframe, which could indicate enumeration or phishing attempts.
Detects network communication patterns
Detects DNS queries to domains using common AWS typosquatting patterns such as 'awscloud', 'compute-aws', or billing/security lures.
Detects a ClickFix attack chain involving an email client opening a browser to a suspicious domain, followed by a file download, and subsequent execution via cmd.exe from explorer within a short timeframe. This chain of events is indicative of a social engineering attack designed to trick users into executing malicious files.
This detection aims to identify suspicious popup activity on devices by analyzing process events that launch notifications. The query focuses on detecting referrers that generate multiple unique popup URLs, which could indicate potentially malicious behavior.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects patterns indicative of an Evilginx-style Adversary-in-the-Middle (AiTM) phishing attack. It specifically looks for HTTP requests to hostnames ending in suspicious top-level domains (TLDs) such as .click, .online, .cloud, or .shop, combined with specific URI paths like /wlc/, /load/, or /success/. These patterns are commonly used by AiTM redirectors to capture credentials and session tokens.
Multiple threat actors are compromising Microsoft 365 accounts in phishing attacks that leverage the OAuth device code authorization mechanism.
Attackers trick victims into entering a device code on Microsoft’s legitimate device login page, unknowingly authorizing an attacker-controlled application and granting them access to the target account without stealing credentials or bypassing multi-factor authentication (MFA).
Attackers trick victims into entering a device code on Microsoft’s legitimate device login page, unknowingly authorizing an attacker-controlled application and granting them access to the target account without stealing credentials or bypassing multi-factor authentication (MFA).
This rule detects potential malicious email campaigns by identifying when multiple users submit email reports (e.g., phishing or spam) that share common entities such as sender IP, primary sender address/domain, secondary sender address/domain, or subject line. A configurable threshold determines the minimum number of distinct reports required to flag an entity as suspicious.
Page 66 of 78