Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,631 detections
Filters
Last updated
All Time
Detection languages
1,055
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
403
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,631
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
here we go with another quick and dirty one to detect Phishing Urls in Emails listed on phishunt.io Feed.
Recommended Action move to Junk Mail Folder or Delete the Message
Recommended Action move to Junk Mail Folder or Delete the Message
This rule detects network connections to known EvilGinx phishing infrastructure, identified by specific remote URLs, IP addresses, and a suspicious login URL pattern. EvilGinx is a phishing framework used for credential harvesting and session cookie theft, often employing adversary-in-the-middle techniques.
This rule detects and correlates Microsoft Defender's Zero-hour Auto Purge (ZAP) actions on emails. It joins original email delivery events with subsequent ZAP actions (Malware ZAP or Phish ZAP) to calculate the dwell time between an email's delivery and its removal. This helps in understanding how long a malicious or phishing email was present in a user's inbox before being remediated, which is crucial for incident response and assessing potential user interaction with the threat.
This rule detects emails containing URLs that match domains identified as phishing domains by cert.pl. It joins email URL information with a regularly updated list of known malicious domains from cert.pl and then correlates these with email events to identify potential phishing attempts.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity, commonly associated with frameworks like Evilginx. The rule identifies suspicious domain patterns where legitimate identity provider (IdP) domains are used as subdomains of another domain, or where IdP-related keywords are used in hyphenated subdomains.
Mustang Panda conducted a phishing campaign against Myanmar entities using a compromised embassy email. The lure involved a PDF with an embedded URL that delivered a ZIP archive containing a trojanized executable and malicious DLL. The malware disguised itself as a PDF, sideloaded the DLL, established persistence, and executed further payloads. It performed system reconnaissance, data exfiltration via SFTP, and defense evasion.
Detects successful non-interactive sign-ins to Microsoft Graph using the Visual Studio Code (VSCode) application identity. This behavior was observed in a phishing campaign where threat actors tricked users into an OAuth flow to harvest tokens. These tokens were then used to access user data, such as emails, via the Graph API.
Detects incoming emails that contain suspicious attachment types (e.g., RAR, ZIP) or links to file-sharing services, combined with subject lines commonly used in phishing campaigns. This pattern is indicative of initial access attempts via spear-phishing.
This detection looks for emails which include URLs with ‘amp/s’. This is an indicator of Google AMP Phishing which uses legitimate Google domains to redirect to the malicious URLs. When detected this is a high confident sign of phishing.
This detection identifies network connections to domains that may be impersonating ConnectWise or ScreenConnect for credential harvesting purposes. The logic is based on tactics observed in the MCTO3030 campaign which used domains with specific country-code TLDs or generic "connectwise" and "screenconnect" themes.
Hunts for abuse of Microsoft 365’s Direct Send feature where attackers send spoofed emails appearing internal, bypassing filters. Includes detection of suspicious DNS queries, outbound network connections, and PowerShell abuse for insider misuse.
This rule identifies users who have clicked on specific URLs that are known to be associated with phishing attempts. It correlates email URL information with URL click events to pinpoint users who interacted with malicious links shared via email. This is particularly useful for identifying victims of targeted phishing campaigns.
This rule identifies users who clicked on URLs within emails from a specific sender. It correlates email events, URL information, and URL click events to pinpoint which users interacted with links in emails, particularly useful for tracking responses to potential phishing attempts from a compromised account.
This rule identifies inbound emails that have been delivered to the organization's email domain and are categorized as 'Phishing' by the email security system. It specifically looks for phishing indicators within the email's attachment or body. The query then summarizes the count of such emails by their URL domain, sorting them to highlight the most frequent phishing domains. The accompanying Python script demonstrates how to cross-reference these identified URL domains with VirusTotal for further analysis.
This rule identifies and analyzes user interactions with URLs embedded in emails, specifically focusing on emails that are either inbound or intra-organizational. It determines which users clicked on URLs within these emails and provides a summary of this activity. This analysis is particularly useful in security contexts, where understanding user behavior regarding potentially risky links can help in identifying phishing attacks or other malicious activities.
Hackers steal Microsoft logins using legitimate ADFS redirects
This rule detects Tycoon and ODx AiTM phishing activity that bypasses MFA. It matches:
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
Hunts for Office 365 emails that contain URLs of popular Monero exchanges or keywords related to Monero wallet addresses. This could indicate phishing attempts, scams, or other illicit activities.
Detects network traffic associated with the Tycoon and ODx phishing kits, which are used in Attacker-in-the-Middle (AiTM) phishing campaigns to bypass MFA. The rule identifies connections to known malicious domains, IP addresses, and specific URLs used by these kits.
This rule consolidates multiple detections related to a widespread malspam campaign delivering the Nova infostealer. It hunts for activity across email, network, DNS, and firewall logs associated with known malicious domains, IPs, and specific TTPs like suspicious archive attachments from impersonated brands.
This rule detects instances where a user clicks on a URL within an email, and subsequently, the email is moved to quarantine. This sequence of events suggests that the email was initially delivered, a user interacted with a potentially malicious link, and then a post-delivery security action (quarantine) was taken, indicating a delayed detection of a threat, likely phishing or malware.
Page 69 of 78