Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
57 detections
Filters
Last updated
All Time
Detection languages
27
18
6
3
2
Contributors
16
11
6
5
4
Categories
35
13
13
10
10
Platforms
25
19
11
4
4
Products / Services
26
18
14
5
4
MITRE Techniques
18,106
15,611
12,573
8,383
6,202
IDS Classtypes
6
4
4
3
1
IDS Protocols
14
3
1
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects a pattern associated with ShinyHunters/UNC6040, where a user authorizes a new or rarely-used OAuth connected application shortly after performing a help-desk initiated password reset or MFA re-enrollment, originating from a different geographic location.
Detects network activity associated with the JWR Phishing Framework, specifically focusing on the initiation of a WebSocket upgrade request following the delivery of a checkout-themed page load containing a 'cart_data' parameter, which is characteristic of the framework's C2 communication flow.
Detects the execution of binaries masquerading as legitimate software (such as KeePass, Adobe Flash, or specialized medical document viewers) from user-writable and non-standard execution paths (e.g., Downloads, Temp). This behavior is characteristic of the CHOSEN BRICK malware's lure-execution stage, where users are socially engineered into running a decoy installer.
Detects network activity associated with the JWR Phishing-as-a-Service (PhaaS) platform. This includes the retrieval of the client-side JavaScript engine (main.js) from lookalike domains related to courier or government services, and subsequent client-side detection of the 'window.__HOST_MODE' flag, which indicates the browser has been primed for a specific phishing scenario.
Detects phishing emails masquerading as legitimate DocuSign remittance advice notifications. The rule identifies emails containing specific keywords related to PDF sharing or remittance advice originating from 'docusign' and featuring suspicious, alternating-case hyperlinks often used in credential phishing campaigns.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This rule monitors Microsoft Teams communications for keywords related to passkey or Single Sign-On (SSO) configuration, which are common themes in social engineering and credential harvesting attacks. It correlates these messages with Windows logon events (Event ID 4624) for the sender to identify potentially compromised accounts or active phishing attempts originating from within the environment.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This KQL detects potential social engineering and vishing activity in Microsoft Teams over the last 30 days.
Detects successful post-delivery email remediation actions (such as ZAP, manual deletion, or moving to junk) performed on emails associated with the Operation DoppelBrand campaign, identified by specific sender domains (service-nowinc.com, domainlify.net) or suspicious invoice-fraud subject lines.
This rule detects DNS queries and TLS SNI traffic directed towards identified phishing or malicious domains that mimic Passkey, Single Sign-On (SSO), or help desk authentication portals. These domains are commonly used by attackers for credential harvesting or adversary-in-the-middle (AiTM) phishing attacks targeting organizational authentication services.
Detects phishing attempts related to 'Operation DoppelBrand' campaign using common email service providers (ESPs) to spoof legitimate-looking emails with fraud-themed subjects, such as invoices or payment requests, associated with the Brickstorm malware.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects successful post-delivery email remediation actions (such as ZAP, manual deletion, or moving to junk) performed on emails associated with the Operation DoppelBrand campaign, identified by specific sender domains (service-nowinc.com, domainlify.net) or suspicious invoice-fraud subject lines.
Page 1 of 3