Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
84 detections
Filters
Last updated
All Time
Detection languages
37
23
16
3
2
Contributors
20
15
11
8
7
Categories
54
24
17
14
14
Platforms
34
30
15
8
5
Products / Services
34
23
16
13
10
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
7
6
5
4
1
IDS Protocols
11
6
4
Domains that introduce substitutions, extra characters, or randomness (e.g., micr0soft, paypa1-secure) tend to have higher entropy than the original brand name. This increase in entropy is a useful signal for detecting typosquatting and brand impersonation attempts in phishing campaigns.
This rule detects potential malicious email campaigns by identifying when multiple users submit email reports (e.g., phishing or spam) that share common entities such as sender IP, primary sender address/domain, secondary sender address/domain, or subject line. A configurable threshold determines the minimum number of distinct reports required to flag an entity as suspicious.
Detects network connections to dedicated IP addresses previously used to host Evilginx phishing proxies. While the threat actor has reportedly shifted to using Cloudflare, these IPs represent past infrastructure and should be monitored for potential reuse.
Detects a high volume of Microsoft Teams invitation emails sent to multiple users within the organization. This could indicate a reconnaissance attempt or a widespread phishing campaign where an attacker is trying to lure users into a malicious external tenant, bypassing some internal security controls.
This detection identifies network traffic to domains explicitly listed as associated with recent phishing campaigns. It specifically looks for these domains within the RequestURL field of logs from Palo Alto Networks or Cato Networks firewalls/proxies.
The attacker then overlays fake intrusive elements (e.g. cookie banners, popups, or CAPTCHA) so that the user’s clicks fall on the hidden password manager controls, resulting in completing the forms with sensitive information.
Detects potential Unicode-based homograph attacks by scanning for non-ASCII characters in both DeviceNetworkEvents.RemoteUrl and EmailUrlInfo.Url. These attacks leverage visually deceptive domain names—using characters from non-Latin scripts (e.g., Cyrillic "а" instead of Latin "a")—to mimic legitimate sites and deceive users.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
KQL Query from file: The Hunt for Blob Phishing Mail Domain
KQL Query from file: Threat Hunting Mshta with Sentinel TI
KQL Query
This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of remote code execution on a vulnerable Linux server.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of remote code execution on a vulnerable Linux server.
This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances where the attacker commanded the Kinsing miner file to be downloaded on Linux devices.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances where the attacker commanded the Kinsing miner file to be downloaded on Linux devices.
'Alerts in links that have been shared across multiple Zoom chat channels by the same user in a short space if time.
Adjust the threshold figure to change the number of channels a message needs to be posted in before an alert is raised.'
Adjust the threshold figure to change the number of channels a message needs to be posted in before an alert is raised.'
This query helps reviewing malicious email detections by detection methods
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
This query helps reviewing zero day threats via URL and file detonations
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
This query helps hunting for good emails from senders with bad patterns
This query helps reviewing list of top 10 URL domains attacking the organization
Page 4 of 4