Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,631 detections
Filters
Last updated
All Time
Detection languages
1,055
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
403
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,631
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
This rule detects HTTP POST requests to github.com's /login/device/code endpoint containing a 'client_id=' parameter in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens or facilitate unauthorized access to GitHub accounts.
This rule detects a highly suspicious sequence of events: a user clicking on a URL (potentially a phishing link) followed by a risky sign-in attempt to Azure AD from an IP address outside the organization's defined range. The rule specifically looks for sign-ins with a high-risk level (>= 50) that occur after a URL click event, suggesting a potential compromise initiated by a phishing attack.
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
Detects URLs that use the `https://user@host` syntax where the 'user' part is crafted to look like a legitimate domain (e.g., `https://example.com@malicious-site.net`). This is a technique used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) to craft convincing phishing links.
Detects URLs that use the `https://user@host` syntax where the 'user' part is crafted to look like a legitimate domain (e.g., `https://example.com@malicious-site.net`). This is a technique used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) to craft convincing phishing links.
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
These domains are actively used in phishing campaigns impersonating legitimate software platforms like Homebrew, LogMeIn, and TradingView to distribute Odyssey Stealer and AMOS malware. Blocking these domains can prevent access to malicious download sites.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
This rule detects potential SVG-based phishing attempts originating from Microsoft Outlook. It correlates network access, file downloads, and URL click telemetry to identify instances where Outlook initiates connections to or downloads files ending with '.svg'. This is particularly relevant for detecting phishing campaigns that leverage malicious SVG files to embed JavaScript, redirectors, or Base64-encoded HTML payloads for credential harvesting or other malicious activities.
The analytic detects a process creating a `.lnk` file in suspicious locations such as `C:\Users\*` or `*\Local\Temp\*`. This activity is significant because creating `.lnk` files in these directories is a common tactic used by spear phishing tools to establish persistence or execute malicious payloads. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects HTML phishing pages created by the 'IUAM ClickFix Generator'. These pages mimic browser verification challenges to trick users into executing malicious PowerShell or Bash commands to deliver infostealers like DeerStealer and Odyssey.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
KQL Query
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc., and connects to a web application over http(s). This could indicate a possible phishing attempt, where a malicious document is used to redirect a user to a malicious website.
This KQL query analyzes Microsoft Entra ID (formerly Azure AD) sign-in and audit logs to identify potentially risky multi-factor authentication (MFA) registration events. It works by checking for MFA registrations initiated from a new, previously unseen IP address.
The query joins historical sign-in data with recent MFA-related events. It calculates how many unique days an IP address has been used by a specific user over the last 30 days. It then flags any MFA registration event from the last 24 hours where the IP address is a new IP (seen zero days before). The final results are filtered to exclude events from new user accounts (created in the last 60 days) to focus on more established accounts.
The query joins historical sign-in data with recent MFA-related events. It calculates how many unique days an IP address has been used by a specific user over the last 30 days. It then flags any MFA registration event from the last 24 hours where the IP address is a new IP (seen zero days before). The final results are filtered to exclude events from new user accounts (created in the last 60 days) to focus on more established accounts.
Detects a user authorizing a Salesforce application via the '/setup/connect' page. This specific TTP is associated with ShinyHunters vishing campaigns where attackers impersonate IT staff and trick employees into entering a connection code, thereby granting a malicious application access to the organization's Salesforce environment.
Page 68 of 78