Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
213 detections
Filters
Last updated
All Time
Detection languages
160
16
13
6
5
Contributors
37
34
31
28
25
Categories
166
59
39
36
23
Platforms
128
34
29
27
25
Products / Services
146
23
21
17
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
6
IDS Protocols
4
2
Detects phishing emails that impersonate Scotiabank using the 'From' display name, while originating from a non-scotiabank.com domain. The rule identifies emails that bypass SPF and DMARC checks and originate from GoDaddy-hosted email services, as indicated by the 'X-SECURESERVER-ACCT' header, suggesting the use of a compromised small-business account.
Detects web traffic where a user initiates a request for content related to 'policy', 'conduct', 'compliance', or 'handbook', experiences at least three redirects across different hosts, and ultimately lands on a page containing keywords indicative of a login, sign-in, OAuth, or authorization prompt. This pattern is often used in multi-stage phishing campaigns to obscure the malicious infrastructure.
Detects a two-stage credential page that receives an email address and then requests tenant branding or a password form during the same browser session. This behavior is indicative of advanced phishing attacks that attempt to mimic legitimate login flows.
Detects execution of custom PowerShell phishing tools (first.ps1, main1.ps1) that present fake Windows update screens to steal local credentials. This rule specifically looks for PowerShell processes where the command line contains 'CredPhish' and either 'main1.ps1' or 'first.ps1'.
Detects pages impersonating IT support staff for social engineering attacks
Detects inbound spearphishing emails impersonating Scotiabank with Interac e-Transfer financial urgency lures targeting executive/VIP mailboxes from first-time external senders, with multiple variants delivered within one hour.
Detects device code authentication via Microsoft Authentication Broker targeting Microsoft Graph, which is a known indicator of Adversary-in-the-Middle (AiTM) attacks or device code phishing.
Detects a click originating from a legitimate email or marketing redirection service and ending on a page that requests enterprise credentials. This behavior is indicative of a phishing attempt where an adversary leverages trusted email services to redirect users to a credential harvesting site.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
This rule detects inbound emails that have failed SPF and/or DKIM authentication checks and presents evidence of post-delivery user interaction. Authentication failures on inbound email are a strong indicator of email spoofing or unauthorized sending infrastructure, commonly associated with phishing campaigns targeting organizational users.
Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email:
URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site
Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient
Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device
Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email:
URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site
Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient
Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device
Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects inbound emails containing Google Forms links with the '/edit?invite=' parameter. This parameter grants editor privileges and is frequently abused in data harvesting campaigns to bypass traditional email gateway URL filtering.
Detects phishing links with credential harvesting redirects
Detects phishing links with credential harvesting redirects
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
Detects generic phishing pages serving credential capture forms to victims
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
This rule detects potential spearphishing attempts targeting high-value individuals (CEO, CFO, IT Admin) within an organization. It looks for emails sent to these individuals with subjects commonly associated with financial phishing or social engineering lures, such as "Invoice," "Wire Transfer," "Payment," "Urgent," or "Purchase Order." The rule also checks if these emails contain attachments, which is a common vector for delivering malware or credential harvesting documents in phishing campaigns. It summarizes the attempts by sender, recipient, and day, counting the number of attempts and listing the attachments.
Page 6 of 11