Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
89 detections
Filters
Last updated
All Time
Detection languages
61
10
8
5
3
Contributors
52
10
6
4
3
Categories
58
33
19
7
6
Platforms
57
21
10
7
7
Products / Services
63
15
12
6
5
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
5
IDS Protocols
5
Detects inbound email or ticketing messages containing extortion language (such as payment deadlines, leak-site references, and data-shredding threats) specifically directed at high-value internal targets like executives, security teams, and legal departments. This pattern is consistent with the ShinyHunters 'pay-or-leak' extortion model.
Detects internal spearphishing emails containing subjects and body text commonly associated with payroll fraud, specifically attempts to solicit changes to employee direct deposit accounts by requesting voided checks or information about upcoming payments.
Detects potential Business Email Compromise (BEC) fraud involving AI voice-cloning. The rule correlates external or unrecognized Microsoft Teams activity (calls/chats) directed at finance users with high-value financial transactions or vendor bank detail updates occurring on the same day, specifically when these transactions lack evidence of legitimate out-of-band or second-approver verification.
Detects modifications to payroll direct deposit or payment election settings within Workday. This activity is a common indicator of payroll fraud or Business Email Compromise (BEC), where an attacker gains access to an employee's Workday account to redirect salary payments to an unauthorized bank account.
Detects inbound email messages containing keywords and phrases consistent with extortion attempts, specifically referencing stolen data, unauthorized access, and demands for cryptocurrency payment.
This rule detects potential Business Email Compromise (BEC) attempts where external senders impersonate corporate executives (e.g., CEO, CFO) by spoofing display names or using lookalike/cousin domains. It triggers when these impersonations are combined with urgent, financial-themed language in the email subject line (e.g., wire transfers, payroll changes, or gift card requests).
This rule detects potential Business Email Compromise (BEC) attempts where an attacker impersonates an executive (CEO, CFO, etc.) via email. It identifies emails where the Sender's display name suggests a high-level executive role, but the domain of the Reply-To address differs from the sender domain, which is a common indicator of a fraudulent routing attempt. The rule further narrows this down to emails with subject lines typical of financial-themed urgency or requests.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
This rule detects potentially malicious outbound email activity sent through Microsoft Graph or Exchange APIs using unknown or infrequently seen client applications. It identifies scenarios where these applications send emails containing financial keywords (e.g., 'invoice', 'wire transfer'), which is a common indicator of Business Email Compromise (BEC) and 'EvilTokens' style mail-vault activity where attackers intercept or inject themselves into existing financial threads.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects outbound email replies concerning invoices or payments sent by a user shortly after performing a device-code authentication flow, indicative of an ARTSender proxy attack where the attacker hijacks an existing email conversation to conduct Business Email Compromise (BEC).
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects incoming emails to finance or accounts payable aliases that contain urgent payment-related keywords and suspicious patterns, such as subject lines including dollar amounts or emails where the Reply-To address domain differs from the Sender domain. This activity is highly indicative of BEC fraud attempts targeting payment redirection.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects high-value wire transfers (>= €600,000) directed to beneficiaries in Hong Kong that contain suspicious memo or description fields related to confidential acquisitions or professional service retainers, potentially indicating business email compromise (BEC) or fraudulent financial activity.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects forged NDA documents used in Phantom Deal fake acquisition fraud, requiring corroborating secrecy-clause language and M&A-fraud-specific wire-transfer/payment phrasing alongside impersonated advisory brands
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects incoming emails to finance or accounts payable aliases that contain urgent payment-related keywords and suspicious patterns, such as subject lines including dollar amounts or emails where the Reply-To address domain differs from the Sender domain. This activity is highly indicative of BEC fraud attempts targeting payment redirection.
Page 1 of 5