Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
19
4
3
1
Contributors
9
7
4
3
2
Categories
17
7
5
4
3
Platforms
17
6
5
5
1
Products / Services
19
8
3
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
3
IDS Protocols
2
1
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Detects a mail bombing pattern where a recipient receives a burst of inbound emails from many distinct senders within a short time window, followed by a Microsoft Teams message or chat creation from the same user context shortly after.
Detects the execution of known remote access tools (AnyDesk, TeamViewer, Quick Assist) on Windows systems. The rule is intended to be used in a correlated detection pipeline that identifies a multi-stage attack chain involving an initial email-bombing flood followed by an external Microsoft Teams vishing call impersonating IT support.
Detects the execution of known remote access and support tools on a host shortly after an email bombing or spam flood alert has been generated for the same user. This pattern is commonly associated with social engineering campaigns where attackers overwhelm a user's inbox to distract them while coercing them into running remote support software to 'resolve' the issue.
Detects signs of email bombing by monitoring for critical thresholds in mail server queue size, transfer latency, or a significant spike in SMTP connection attempts targeting individual mailboxes. This activity often aims to disrupt email service availability, bury critical alerts, or facilitate social engineering attacks.
Detects a high volume of subscription or account confirmation emails directed at a single recipient within a one-hour window. This behavior, often referred to as 'email bombing,' can be used to disrupt user productivity, overwhelm inbox capacity, or serve as a distraction technique to hide other malicious activities, such as spearphishing or account takeover notifications.
Detects instances where a high-value security or transaction-related notification email is received concurrently with a burst of non-essential bulk or subscription-based emails. This pattern is indicative of an email-bombing (inbox flooding) attack, often used to bury critical alerts and mask malicious activity such as unauthorized account access or fraudulent financial transactions.
Detects email bombing attacks via high-volume inbound email delivery
This rule detects an outbound email bombing campaign by monitoring TCP connections to port 25 (SMTP). It triggers an alert if a single source IP address initiates 200 or more established connections to port 25 within a 60-second window. This high volume of outbound email connections from a single source is indicative of an attempt to overwhelm an email server or recipient with a large number of emails, often associated with denial-of-service attacks.
This rule detects a high volume of inbound emails to port 25 (SMTP), indicating a potential email bombing attack. It triggers an alert if more than 100 emails are received from a single source IP address within a 60-second window.
This rule detects an 'Email Subscription Bomb' attack, where an attacker automates sign-ups to various services using a victim's email address. The goal is to flood the victim's inbox with confirmation emails, potentially causing a denial of service or distracting them from other malicious activities. The rule specifically looks for SMTP traffic to port 25 containing the phrase 'confirm your subscription' (case-insensitive) and triggers an alert if this content is seen 50 times within 60 seconds from the same destination IP address.
KQL Query from file: Email Bombing and Teams Impersonation Detection
KQL Query from file: Storm 1811 SE Attack Detection
Analyze Mail Bomb Attack by ISP
KQL Query
This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls.
KQL Query from file: Social Engineering Attack Detection
KQL Query
KQL Query from file: Hunt for High Volume Phish ISP
This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
This query helps reviewing recipients who are potentially victim of email bombing attacks
Page 1 of 2