Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
5
5
Contributors
5
3
2
Categories
5
5
5
3
1
Platforms
5
5
3
3
Products / Services
5
5
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
5
IDS Protocols
5
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects potential vendor relationship page scraping activity. It triggers an alert when a client makes 20 or more HTTP requests containing the word "vendor" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated script attempting to gather information about an organization's vendors, which is a reconnaissance technique.
This rule detects potential business partner directory scraping by monitoring HTTP requests to the server. It triggers an alert if a client makes 15 or more requests containing 'partners' (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated tool attempting to enumerate or collect information about an organization's business partners.
This rule detects enumeration attempts of partner and vendor pages on a web server. It triggers when a client makes 20 or more HTTP requests containing the case-insensitive string "partner" in the URI within a 30-second window, indicating a potential reconnaissance activity to discover sensitive or specific sections of a website.
Supplier Chain Page Enumeration
Suricata
This rule detects potential enumeration of supplier-related pages on a web server. It triggers when a client makes 15 or more HTTP requests containing the case-insensitive string "supplier" in the URI within a 30-second window. This behavior could indicate an attacker attempting to discover sensitive information or entry points related to an organization's supply chain.
This rule detects a potential client portfolio page enumeration by monitoring HTTP requests. It triggers an alert if a client makes 15 or more requests containing the string "clients" (case-insensitive) in the HTTP URI within a 30-second window. This behavior is indicative of an attacker attempting to discover or enumerate client-related pages or resources on a web server, possibly as part of a reconnaissance effort.
This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology