Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
213 detections
Filters
Last updated
All Time
Detection languages
160
16
13
6
5
Contributors
37
34
31
28
25
Categories
166
59
39
36
23
Platforms
128
34
29
27
25
Products / Services
146
23
21
17
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
6
IDS Protocols
4
2
Detects Microsoft Teams communication (calls, chats, messages) originating from a different tenant where the sender's display name is identified as IT Support, Help Desk, or similar. This behavior is indicative of external actors attempting to impersonate internal IT staff to facilitate social engineering or credential harvesting.
This rule monitors email, SMS, and voice logs for potential phishing attempts targeting user credentials. It specifically looks for social engineering lures related to passkey, SSO, or MFA updates that express urgency or imply service expiration, often masquerading as IT support communications.
Detects network activity characteristic of JWR or Outsider-style live phishing kits. The rule monitors for specific instruction tokens (e.g., card entry, verification codes, success indicators) in network requests within a short time window, indicating an operator-driven phishing session.
This rule monitors email or communication logs for phishing lures themed around 'passkey' or 'sso' (Single Sign-On). It looks for indicators of urgency, helpdesk impersonation, or targeting of personal devices, which are often precursors to Adversary-in-the-Middle (AiTM) or device-code phishing attacks.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
Detects browser navigation events where the target URL is a locally generated 'blob:' URI that includes keywords associated with common credential harvesting targets (e.g., login, Microsoft 365, DocuSign). Adversaries use blob URIs to render phishing content directly from memory, which can help bypass certain static URL reputation filters and email security gateways.
This KQL detects potential social engineering and vishing activity in Microsoft Teams over the last 30 days.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
Detects DNS queries for suspicious domains that use keywords typically associated with credential harvesting, passkey-based phishing, or rogue SSO/authentication portal setups. The rule flags domains containing terms like 'passkey', 'oktasession', 'keysync', and various 'setup' or 'connect' variations designed to deceive users into providing authentication credentials.
Detects potential social engineering attacks in Microsoft Teams where an internal user sends multiple messages containing terms related to MFA, SSO, or passkey updates, potentially attempting to harvest credentials from other users.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects inbound emails or URL click events that contain specific keywords associated with the PREY-0058 vishing campaign. These keywords are used to lure victims to attacker-controlled pages designed for credential harvesting or MFA/passkey registration.
This rule detects potential credential or token theft attempts from the N0va phishing kit. It monitors for emails lacking attachments that contain specific URL patterns associated with verification or session initialization, coupled with social engineering tactics such as spoofing legitimate service display names or subjects (e.g., Microsoft Teams, DocuSign, etc.) while originating from non-legitimate domains.
Detects Microsoft Teams messages containing keywords related to authentication updates, passkey enrollment, or SSO changes combined with urgent language or calls to action (e.g., clicking links). The rule attempts to identify potential credential harvesting or account takeover attempts within the chat platform.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.
Detects inbound emails originating from external, non-corporate domains that impersonate an internal executive's display name. The rule flags messages containing common Business Email Compromise (BEC) urgency or confidentiality triggers such as 'wire transfer', 'urgent', 'NDA', or 'private email'.
Detects inbound emails originating from external, non-corporate domains that impersonate an internal executive's display name. The rule flags messages containing common Business Email Compromise (BEC) urgency or confidentiality triggers such as 'wire transfer', 'urgent', 'NDA', or 'private email'.
Page 2 of 11