Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
23
2
2
Contributors
12
4
4
2
2
Categories
11
10
6
4
4
Platforms
20
3
3
3
1
Products / Services
21
4
2
2
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
IDS Protocols
2
Detects potential Business Email Compromise (BEC) by monitoring inbound email threads for unexpected changes in the sender domain during ongoing conversations. This rule flags replies that contain payment-related keywords (e.g., IBAN, SWIFT, bank details) where the sender domain has not been observed in the previous 30 days of the thread's history.
Detects a sequence of events starting with a user signing in via the OAuth device code flow, followed immediately by mailbox item enumeration and sending of email. This pattern is characteristic of attackers who use device code phishing to steal tokens, subsequently using those tokens to access mailboxes and send malicious emails from the compromised account.
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
Detects a Telegram account session being authorized from a new device/IP, which BlueNoroff has been observed abusing as the precursor step in the GhostCall self-propagation pipeline: operators reuse stolen/hijacked Telegram session cookies from a new device or IP, then use the hijacked session to send fake meeting invites to trusted contacts, enabling cyclical propagation to subsequent victims.
This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
This rule detects potential phishing emails originating from the gasparinutrition.com domain. It identifies suspicious email delivery patterns involving the use of Google Workspace relay (gappssmtp.com) combined with DKIM misalignment and DMARC failures, indicating possible domain spoofing or unauthorized relay usage.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign using compromised legitimate domains to bypass email authentication controls.
Detects SMTP connections originating from the persistent Gamaredon operator subnet (194.58.66.0/24) on port 25.
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
This rule detects a brute-force attack against a POP3 email account. It triggers when 20 or more TCP connections are made to port 995 (POP3S) on the HOME_NET within a 30-second window from the same source IP address. This pattern is indicative of an attacker repeatedly attempting to guess credentials.
This rule detects a brute-force attack against an IMAP email account. It triggers when a source IP attempts to connect to the IMAP port (993) on the home network 20 or more times within a 30-second window. This behavior is indicative of an attacker repeatedly trying different credentials to gain unauthorized access to an email account.
This rule detects instances where a SharePoint or OneDrive file/folder is shared with a guest user whose email address is identified as a threat intelligence indicator. This could indicate an attempt to exfiltrate data to a known malicious entity or an account compromise being used for data staging.
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
KQL Query from file: Hunting DragonForce with ANY.RUN Threat Intelligence
KQL Query
KQL Query from file: Outlook New Requirements for High‐Volume Senders
This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology
This query visualises user submissions where admin also performed 'mark and notify' action on the submission
This query helps hunting for Inbox rule changes which forward-redirect email
Listing Email Remediation Actions performed via Explorer in Defender for Office 365
Page 1 of 2