Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60 detections
Filters
Last updated
All Time
Detection languages
49
5
3
1
1
Contributors
25
11
7
5
4
Categories
52
34
7
4
2
Platforms
53
8
4
2
1
Products / Services
53
10
6
4
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
3
IDS Protocols
3
Detects inbound email that fails SPF authentication indicating email spoofing
This query visualises total emails with Spoof - DKIM fails summarizing the data daily.
This rule detects SMTP traffic where an email is failing SPF (Sender Policy Framework) authentication. Specifically, it looks for the 'Received-SPF: fail' header in emails sent to port 25 ($HOME_NET). This indicates that the sending server is not authorized to send email on behalf of the domain specified in the email's 'MAIL FROM' address, which is a strong indicator of a phishing attempt or spoofed email.
This rule detects emails sent over SMTP where the 'From:' and 'Reply-To:' headers are present, indicating a potential attempt to spoof the sender's display name while using a different domain. It triggers an alert if 10 such emails are observed from the same source within 60 seconds, suggesting a bulk email or phishing attempt.
This rule detects email spoofing attempts where the 'From' address domain does not match the 'Return-Path' address domain. It specifically looks for SMTP traffic on port 25, ensuring the flow is established and to the server. The rule uses PCRE to extract the domain from the 'From' header and then checks if the 'Return-Path' header contains a different domain.
Identifies emails spoofing NIPR, NAIC, or Stripe domains with invoice-related lures that fail authentication. This rule specifically looks for emails where the sender's domain (SenderFromDomain or SenderMailFromDomain) is one of the targeted domains (nipr.com, naic.org, stripe.com), the subject contains keywords like 'invoice' or 'past due', and the email authentication details do not indicate a 'pass'. This combination suggests a phishing attempt leveraging brand impersonation and financial urgency.
Detects a single Gmail sender address using multiple distinct display names within a short timeframe (1 hour). This behavior can indicate an attempt at impersonation, phishing, or spam campaigns where an attacker tries to appear as different entities from the same compromised or controlled email account.
In May 2025, a campaign started using the Microsoft Exchange Direct Send feature to send phishing mails to organizations. This feature is designed for use by printers, scanners, cloud services and other devices that need to send messages on behalf of the company. This detection rule tries to detect the malicious mails being send via Direct Send using a couple of indicators:
- Sender email is the same as Recipient email
- SPF and DMARC both failed
- Mail is not comming in via an Exchange connector
- The sender IP address country is not a country that the user is known to login from
FYI, if you remove the country check (last line of the query), you can use the query to identify if there are legitimate mails as well. If not, you can disable the Direct Send feature in Exchange Online.
- Sender email is the same as Recipient email
- SPF and DMARC both failed
- Mail is not comming in via an Exchange connector
- The sender IP address country is not a country that the user is known to login from
FYI, if you remove the country check (last line of the query), you can use the query to identify if there are legitimate mails as well. If not, you can disable the Direct Send feature in Exchange Online.
This rule detects inbound emails where the sender's domain contains "microsoft" but does not end with "microsoft.com". This is a common tactic used in phishing attacks to spoof legitimate Microsoft domains, tricking recipients into believing the email is from a trusted source.
KQL Query
This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls.
KQL Query from file: Phishing campaigns leveraging Microsoft Forms
KQL Query from file: AppSheet.com abused to send Phish
KQL Query from file: Hunt for High Volume Phish ISP
KQL Query
This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily.
This query visualises total emails with Spoof - SPF fails summarizing the data daily.
Page 2 of 3