Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
18
16
11
8
7
Contributors
26
15
3
3
3
Categories
22
12
10
10
8
Platforms
20
19
16
13
10
Products / Services
28
11
9
7
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
8
2
1
IDS Protocols
7
3
1
Detects DNS queries and TLS SNI traffic associated with known authentication-themed lure domains often used in phishing campaigns. These domains mimic multi-factor authentication (MFA) registration or SSO setup processes to deceive users into credential theft.
This rule detects potential adversary-in-the-middle (AiTM) or device-code authentication attacks where a user reports suspicious vishing (voice phishing) or SMS lures involving passkeys or SSO updates. The rule correlates user-reported social engineering pretexts with evidence of risky authentication flows, such as device code usage or specific authentication error codes associated with interception.
Detects internal phishing messages sent via Microsoft Teams that contain common credential-harvesting lures (e.g., passkey, MFA, SSO updates) where the sender account has also exhibited indicators of compromise within the preceding 24 hours, such as risky sign-ins or impossible travel.
Detects Microsoft Teams chat and message events originating from unverified or external tenants that attempt to impersonate internal IT helpdesk personas. This activity is often part of a multi-stage social engineering campaign, potentially following email bombing, where attackers aim to trick users into executing malicious files or installing remote access tools.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
Detects PowerShell or pwsh processes spawned from Teams.exe with command-line arguments indicative of remote download and execution (e.g. Invoke-WebRequest, curl, encoded commands, IEX, Invoke-Expression, Expand-Archive of a zip archive). This pattern matches the TWINLOOT campaign's initial access chain, in which victims are lured via fake Microsoft Teams messages (T1566.004) into launching malicious content that triggers PowerShell execution (T1059.001) from within the Teams process, consistent with user execution of a malicious link or file (T1204.002).
Detects DNS queries to UNC6671 vishing-lure lookalike domains (createssopasskey/addssopasskey/passkeyhelpdesk) used to harvest credentials after a helpdesk-impersonation vishing call.
Detects a user registering a new MFA or authentication method within a short window after multiple failed Entra ID sign-in attempts, without a corresponding verified helpdesk password-reset ticket. This pattern is indicative of vishing or helpdesk-impersonation attacks aimed at hijacking user accounts by circumventing MFA controls.
Detects inbound voice calls that spoof corporate helpdesk numbers. The rule triggers when an incoming call from an external/PSTN trunk matches a known helpdesk number and exhibits signs of spoofing, specifically either a mismatch between the current call's carrier and historical baseline carrier for that number, or a report by the recipient that the call was suspicious.
This rule monitors web browser URL click events for specific patterns (createssopasskey, addssopasskey) often used in vishing-lure campaigns. It identifies potential Adversary-in-the-Middle (AiTM) credential harvesting attempts by cross-referencing clicked URLs against an organization's approved SSO domain allowlist and verifying the presence of an internal referrer in the redirect chain. If a user clicks a suspect link that does not originate from a known internal source and points to an unauthorized external domain, the event is flagged.
Detects a potential account takeover scenario where a user receives a password reset notification email followed within 10 minutes by a non-SSO application password change from the same IP address. This sequence is characteristic of Adversary-in-the-Middle (AiTM) phishing or vishing campaigns where an attacker intercepts session tokens or uses social engineering to force a password reset and immediately secures the account for persistent access.
UNC6671 AiTM passkey/SSO lookalike domain DNS query
UNC6671 AiTM Phishing Infrastructure - Maintained IOC Dataset Match with TTL-Based Expiry (High Confidence)
Detects the execution of known remote monitoring and management (RMM) or remote access tools shortly after Microsoft Teams process activity on a host. This behavior is consistent with helpdesk-impersonation vishing attacks where an adversary convinces a user to initiate a remote session.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Page 2 of 4