Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
89 detections
Filters
Last updated
All Time
Detection languages
61
10
8
5
3
Contributors
52
10
6
4
3
Categories
58
33
19
7
6
Platforms
57
21
10
7
7
Products / Services
63
15
12
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
5
IDS Protocols
5
Detects inbound emails masquerading as ServiceNow ticket notifications that solicit sensitive information (e.g., vendor IDs, invoice numbers, bank account details) via reply-only body content. This technique evades traditional SEG scanning by avoiding malicious URLs or attachments and leveraging the reputation of legitimate, though spoofed, ServiceNow infrastructure.
This rule detects incoming emails with subject lines containing keywords associated with invoice, payment, or banking detail changes. These patterns are highly characteristic of Business Email Compromise (BEC) and social engineering campaigns designed to redirect financial transactions to fraudulent accounts.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
Detects log entries related to sensitive HR and financial data modifications, specifically identifying keywords such as 'Workday', 'direct deposit', 'payment election', or 'bank account' changes. This activity is indicative of potential payroll fraud, where an adversary attempts to redirect employee compensation to an unauthorized account.
This rule detects extortion emails that claim corporate data theft and threaten public release unless a cryptocurrency payment is made. It looks for a combination of breach-related subject lines, extortion-specific language in the email body, and indicators such as specific cryptocurrency mentions, urgent deadlines, usage of anonymous email providers, or references to attached proof of compromise.
Detects Microsoft 365 OAuth access tokens issued via device_code grant — the mechanism abused by the EvilTokens phishing kit — followed within 1 hour by mailbox forwarding rule creation for the same account, indicating persistent BEC access post-compromise.
Detects potential financial data exfiltration by monitoring for bulk downloads of files with financial keywords from SaaS/Office365 platforms, and identifies unauthorized processes attempting to access sensitive financial application data files (.qbw, .qbb, etc.) on local systems.
Detects automated payroll fraud attempts by monitoring for scripting engines initiating HTTP connections to known payroll platforms (e.g., Workday, ADP) or spawning child processes with payroll-related command-line arguments. This behavior is indicative of post-AiTM session abuse, where attackers manipulate financial accounts or automate unauthorized payroll changes via malicious scripts.
Detects unauthorized changes to sensitive payroll information (such as bank accounts or direct deposit details) or suspicious inbox rule creations within Microsoft 365 or HR SaaS environments that occur immediately following anomalous authentication activity. The rule targets indicators of AiTM (Adversary-in-the-Middle) session hijacking, such as unusual user agents, unmanaged device usage, or potential token reuse.
Detects potential financial data exfiltration by monitoring for bulk downloads of files with financial keywords from SaaS/Office365 platforms, and identifies unauthorized processes attempting to access sensitive financial application data files (.qbw, .qbb, etc.) on local systems.
Detects manipulation of financial transaction data for financial theft
Detects inbound messages whose subject closely matches the campaign's reported stolen client data extortion wording. The rule looks for specific keywords like 'lost', 'confidential', 'data', 'clients' (all present) and 'very important', 'important', 'client data' (any present) in the email subject, specifically for inbound emails that are either the first contact or have no threat types identified.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
This rule detects potential banking web inject form overlays by looking for specific keywords in HTTP response data. It triggers when an HTTP response contains 'account_number', 'routing_number', and 'XMLHttpRequest' (all case-insensitive). This combination of keywords suggests an attempt to inject malicious forms into a legitimate banking website to steal credentials or financial information.
This rule detects HTTP POST requests that are likely associated with financial transaction hijacking by banking Trojans. It specifically looks for HTTP POST requests where the host header or URI contains keywords related to banking or payment services (bank, paypal, stripe, wise, transferwise) and the URI also contains the word 'transfer'. Additionally, the request body size must be greater than 200 bytes, indicating a substantial data transfer, which is common in financial transactions.
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
This rule detects attempts to replace cryptocurrency wallet addresses within HTTP POST requests. It specifically looks for patterns matching Bitcoin (P2PKH, P2SH, Bech32) and Ethereum (0x) wallet addresses in the client body of HTTP POST requests. This activity is indicative of clipboard hijacking or similar malware that aims to redirect cryptocurrency transactions to an attacker's wallet.
Detects web content containing strings associated with destructive commands or unauthorized financial transactions, often embedded as part of an Indirect Prompt Injection (IDPI) attack. These prompts are designed to be executed by an AI agent or LLM, potentially leading to data loss, denial of service, or financial theft.
Detects web navigation to Amazon and AliExpress that contains specific hardcoded affiliate tags used by the 10xprofit extension network. The presence of these tags indicates active affiliate hijacking, likely due to a malicious browser extension.
Detects potential fraud: New payment card added, followed by deposit and large withdrawal (>500) within 24 hours
Page 4 of 5