Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
330 detections
Filters
Last updated
All Time
Detection languages
158
115
22
15
10
Contributors
147
71
32
32
7
Categories
167
156
109
109
96
Platforms
199
104
22
21
17
Products / Services
161
150
64
56
37
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
2
IDS Classtypes
107
17
10
10
8
IDS Protocols
86
35
28
3
1
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects DNS queries and TLS SNI traffic related to known malicious domains used by threat actor groups Storm-3121 and Storm-3032 in passkey-themed phishing campaigns.
Detects DNS resolutions, TLS SNI, and HTTP host requests to known malicious phishing domains impersonating passkey and SSO infrastructure, often associated with Storm-3121/Storm-3032 activities.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
This rule detects DNS queries or network connections originating from endpoints to a list of known malicious domains associated with various malware families (ClearFake, IClickFix, AMOS, Vidar, etc.). This helps identify potential C2 communication, malicious payload delivery, or infrastructure interaction.
This KQL inventories activity associated with a specified root domain and its subdomains across DeviceNetworkEvents, EmailUrlInfo, CloudAppEvents.
Detects network activity and email headers associated with the DoppelBrand campaign. The rule monitors DNS queries for specific IOC domains (service-nowinc.com, domainlify.net) and inspects SMTP traffic for malicious MAIL FROM addresses and Reply-To headers targeting these domains.
Detects network activity and email headers associated with the DoppelBrand campaign. The rule monitors DNS queries for specific IOC domains (service-nowinc.com, domainlify.net) and inspects SMTP traffic for malicious MAIL FROM addresses and Reply-To headers targeting these domains.
Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.
Detects active phishing threat-intelligence indicators whose domain name uses one of the disposable TLDs observed across IronToll's 73+ rotating lookalike domains (.cfd, .sbs, .icu, .buzz, etc.). Scoped to the structured ThreatType classification only — dropped the free-text 'Description has phishing' fallback, since KQL's 'has' is a substring/token match with no negation awareness (e.g. a description stating an indicator is 'not related to phishing' would still match), which could pull in indicators unrelated to actual phishing activity.
Detects active phishing threat-intelligence indicators whose domain name uses one of the disposable TLDs observed across IronToll's 73+ rotating lookalike domains (.cfd, .sbs, .icu, .buzz, etc.). Scoped to the structured ThreatType classification only — dropped the free-text 'Description has phishing' fallback, since KQL's 'has' is a substring/token match with no negation awareness (e.g. a description stating an indicator is 'not related to phishing' would still match), which could pull in indicators unrelated to actual phishing activity.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
Page 11 of 16