Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
12
8
3
2
1
Contributors
11
5
5
2
1
Categories
8
8
8
8
5
Platforms
11
9
9
4
2
Products / Services
14
8
8
3
2
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
6
2
IDS Protocols
7
1
Detects potential vishing activity associated with the Sauron Loader threat. The rule identifies a pattern of a mailbox receiving a high volume of inbound emails (spam or subscription bombs) within a short window, followed by the user launching remote assistance tools like Quick Assist or AnyDesk on the same endpoint, indicating an attacker-guided remote session.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
Detects a sequence of events where a single user receives an unusually high volume of inbound emails (potentially vishing-related), followed shortly thereafter by the user executing common remote assistance or remote access tools (e.g., Quick Assist, AnyDesk). This pattern is consistent with social engineering tactics used in IT-support impersonation scams to facilitate the delivery of malware such as Sauron Loader.
This rule detects access to known malicious domains used in vishing-themed Adversary-in-the-Middle (AiTM) phishing campaigns. Attackers use these domains to deceive users into providing MFA credentials or session tokens, often following a voice phishing interaction where victims are directed to these sites to register or set passkeys.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
This rule detects network activity and cloud API events indicative of an adversary utilizing the VAPI.ai platform to orchestrate automated voice-phishing (vishing) campaigns. It correlates outbound network connections to VAPI.ai endpoints with specific webhook callback patterns used to track call status for victim records.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
Detects a multi-stage Telephone-Oriented Attack Delivery (TOAD) campaign. The first stage identifies phishing emails containing billing or security-themed subjects and phone numbers without links or attachments to evade automated analysis. The second stage monitors for the subsequent installation or execution of common remote-support tools (e.g., AnyDesk, TeamViewer, ScreenConnect). A final correlative rule detects these events occurring sequentially on the same host, indicating a high-confidence indicator of a successful callback phishing social-engineering attempt.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
Detects a sequence of events where a user's MFA configuration is modified (typically via a help-desk impersonation vishing attack) followed closely by a successful sign-in from a new IP address. This pattern is indicative of attackers hijacking sessions or stealing credentials by coercing victims into resetting MFA settings.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
Detects the AnonyMousKIT vishing activity pattern by monitoring Twilio API call creation events followed by specific status or gather webhook callbacks from the same host within a one-hour window, consistent with automated voice phishing to collect DTMF-entered passcodes.
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
This KQL detects potential social engineering and vishing activity in Microsoft Teams over the last 30 days.
Detects inbound emails or URL click events that contain specific keywords associated with the PREY-0058 vishing campaign. These keywords are used to lure victims to attacker-controlled pages designed for credential harvesting or MFA/passkey registration.
Detects DNS queries to UNC6671 vishing-lure lookalike domains (createssopasskey/addssopasskey/passkeyhelpdesk) used to harvest credentials after a helpdesk-impersonation vishing call.
Detects suspicious OAuth consent or connected app authorization followed by SaaS query, export, download, or bulk API activity from the same account within 24 hours, indicating possible OAuth token abuse or SaaS data exfiltration.
This rule detects potential Remote Access Trojan (RAT) callbacks occurring after a remote support session. It specifically looks for HTTP GET requests where the URI contains keywords like 'setup', 'install', 'support', or 'remote' (case-insensitive) and the User-Agent header contains 'MSIE'. This combination suggests a possible RAT communicating with its command and control server, masquerading as legitimate remote support or installation traffic.
Page 1 of 2