Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
6
1
Contributors
3
2
1
1
Categories
2
2
1
1
1
Platforms
3
2
2
1
1
Products / Services
3
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects an applicant identity submitting an abnormally high volume of job applications across many companies within a rolling window, corroborated by resume or portfolio content reused across multiple applicant identities — consistent with PurpleDelta fabricated-persona application tempo.
Detects presence of persona-fabrication and identity-fraud enablement software (Wavebox, MEmu, eSIM Plus, Blacktel, insertFace, TrustID Card) via process, network, or file-system artifacts on an endpoint, consistent with PurpleDelta identity-fraud tradecraft.
Detects a single source device or IP maintaining genuinely time-overlapping sign-in sessions under two or more distinct user identities, excluding known shared/kiosk devices and shared VPN egress points, consistent with a single PurpleDelta operator working multiple jobs simultaneously.
Detects automated social media account registration used for fake identity infrastructure
This rule detects potential automated social media account creation attempts by monitoring HTTP traffic for requests to common social media platforms (twitter.com, x.com, facebook.com) that include 'signup' in the URI. A threshold of 5 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible automated or high-volume registration process.
Detects DNS queries to domains that are suspiciously similar to trusted ones, which may indicate typosquatting, phishing, or user deception tactics. The detection compares unknown domains to a known safe allowlist using a fuzzy character-difference heuristic.
KQL Query from file: Detecting External Microsoft Teams Spray
