Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
89 detections
Filters
Last updated
All Time
Detection languages
61
10
8
5
3
Contributors
52
10
6
4
3
Categories
58
33
19
7
6
Platforms
57
21
10
7
7
Products / Services
63
15
12
6
5
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
5
IDS Protocols
5
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
Detects changes to payment or bank account information in Workday. This activity is associated with 'payroll pirate' attacks by threat actor Storm-2657, who modify payroll details to divert salary payments after compromising an account.
Detects PhantomCard, an Android NFC-relay Trojan targeting banking customers in Brazil. It masquerades as a 'card protection' app and relays NFC data from the victim's card to the fraudster's device.
This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology
This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint
Page 5 of 5