Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
28
3
3
3
1
Contributors
12
4
3
3
3
Categories
22
11
4
4
3
Platforms
23
7
5
4
3
Products / Services
28
4
4
3
2
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Detects outbound network connections to identified infrastructure associated with 'Pink' (CL-CRI-1147) passkey-enrollment vishing campaigns. These operators use phone-based social engineering to direct victims to phishing domains that relay credentials and MFA tokens in real-time to register attacker-controlled passkeys. The rule monitors for specific DNS query patterns containing passkey-related keywords and known malicious IP addresses used by the threat group.
Detects HTTP requests to Gitea instances containing the X-WEBAUTH-USER header, which facilitates user impersonation when Gitea is misconfigured with 'REVERSE_PROXY_TRUSTED_PROXIES = *' in a Docker environment. This vulnerability (CVE-2026-20896) allows an unauthenticated attacker to impersonate any user, including administrators.
This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.
This rule monitors for two distinct suspicious activities: 1) Inbound emails where the sender display name matches a list of executive titles, commonly indicative of Business Email Compromise (BEC) or executive impersonation attacks; 2) The creation of cloud service accounts with names mimicking administrative or IT support roles, which may indicate an adversary establishing persistent, privileged access.
This rule detects potential email spoofing attempts by identifying mismatches between P1 (envelope) and P2 (header) sender addresses, identifying discrepancies between sender and reply-to domains, and flagging emails where the display name impersonates common executive or IT support roles.
This rule monitors for two distinct suspicious activities: 1) Inbound emails where the sender display name matches a list of executive titles, commonly indicative of Business Email Compromise (BEC) or executive impersonation attacks; 2) The creation of cloud service accounts with names mimicking administrative or IT support roles, which may indicate an adversary establishing persistent, privileged access.
This rule detects inbound emails that have failed SPF and/or DKIM authentication checks and presents evidence of post-delivery user interaction. Authentication failures on inbound email are a strong indicator of email spoofing or unauthorized sending infrastructure, commonly associated with phishing campaigns targeting organizational users.
Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email:
URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site
Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient
Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device
Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email:
URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site
Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient
Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device
Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
This rule detects emails sent to the internal network (SMTP port 25) that attempt to impersonate an internal IT department. It specifically looks for the 'From:' header, the phrase 'IT Department' (case-insensitive), and the word 'password' (case-insensitive) within the email content. This combination suggests a social engineering attempt, likely phishing, to trick recipients into revealing credentials.
This rule detects HTTP responses from a server to a client that contain the case-insensitive strings "IT Support", "helpdesk", and "password" within the file data. This combination of keywords suggests a web page designed to impersonate IT support, potentially for phishing or credential harvesting purposes.
Detects inbound emails with voicemail-themed subjects that pass SPF and DKIM but fail DMARC alignment. This technique is often used to exploit domains with p=none policies and obscure the actual origin of phishing attempts.
This rule detects HTTP traffic where the User-Agent header contains 'Microsoft', 'Google', or 'Amazon' (case-insensitive) and the Host header contains an IPv4 address. This combination could indicate an attacker impersonating a legitimate vendor's API client while making direct IP-based requests, potentially bypassing DNS-based security controls or targeting internal services.
KQL Query from file: Email Bombing and Teams Impersonation Detection
This detection identifies a large-scale phishing campaign utilizing legitimate SharePoint Personal (OneDrive) infrastructure from external organizations to deliver malicious lure documents. By sending notifications via the official no-reply@sharepointonline.com address, the attackers bypass many reputation-based filters and exploit user trust in the Microsoft 365 ecosystem.
This detection identifies a large-scale phishing campaign utilizing legitimate SharePoint Personal (OneDrive) infrastructure from external organizations to deliver malicious lure documents. By sending notifications via the official no-reply@sharepointonline.com address, the attackers bypass many reputation-based filters and exploit user trust in the Microsoft 365 ecosystem.
This rule detects potential social engineering attempts in external direct messages (DMs) by identifying messages that impersonate IT helpdesk or support personnel, or discuss 'working from home' scenarios. It specifically looks for keywords like 'helpdesk', 'help desk', 'IT support', and 'working from home' in the recipient details or sender display name of external messages within the last 5 days. The goal is to surface lures that aim to trick users into revealing sensitive information or performing actions under false pretenses.
Detects a single Gmail sender address using multiple distinct display names within a short timeframe (1 hour). This behavior can indicate an attempt at impersonation, phishing, or spam campaigns where an attacker tries to appear as different entities from the same compromised or controlled email account.
Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=", "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption.
Detects potential abuse of Microsoft Actor tokens for cross-tenant impersonation attacks targeting Entra ID tenants. This rule identifies suspicious audit log entries that may indicate exploitation of CVE-2025-55241, a critical vulnerability in Azure AD Graph API that allowed attackers to impersonate any user across Entra ID tenants using malicious Actor tokens.
This rule detects an impersonation event within Microsoft Teams, specifically when the 'TeamsImpersonationDetected' action type is logged. It extracts the User ID and the Sender's User Principal Name (UPN) associated with the detected impersonation.
Page 1 of 2