Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects a multi-stage attack pattern involving a 'spam bomb' (high volume of inbound emails) followed by an external Microsoft Teams message and the subsequent execution of Windows Quick Assist (quickassist.exe or msra.exe) on the target endpoint. This behavior is highly indicative of a tech support scam or social engineering attack where an adversary floods a user's inbox to create urgency, contacts them via Teams, and convinces them to initiate a remote support session.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
Detects anomalous child process execution (PowerShell, mshta, wscript, cscript, or cmd) spawned by common web browsers, which is consistent with the execution chain of CastleLoader malware delivered via EvilTokens PhaaS and ClickFix CAPTCHA lures. These lures typically trick users into copying and pasting commands into the Run dialog or directly into the shell.
Detects automated scripts or command-line utilities initiating connections to Microsoft authentication endpoints using OAuth device code authorization parameters. This behavior is indicative of PhaaS (Phishing-as-a-Service) tools, such as EvilTokens, attempting to perform device code OAuth flows on behalf of an attacker to gain unauthorized access.
Detects potential CastleLoader delivery by monitoring for suspicious child process executions (e.g., PowerShell, cmd, mshta, wscript, cscript) spawned directly by common browser or email client parent processes. This behavior is indicative of a user interacting with a malicious phishing link or attachment as part of a malware delivery chain.
Detects successful sign-ins to Microsoft Graph where Multi-Factor Authentication (MFA) was expected but not applied or not enabled, and the authentication method used was not MFA or passwordlessMFA. This could indicate an MFA bypass or misconfiguration, allowing access to sensitive resources without the required second factor.
Detects the execution of 'aws sts get-caller-identity' spawned by IDE-related processes such as VS Code extension hosts or Amazon Q language servers. This pattern may indicate cloud credential reconnaissance performed by a malicious MCP (Model Context Protocol) server or compromised development extension (CVE-2026-12957).
Detects command lines that reference known supply chain attack targets or commonly used package management tools like npm and pypi, which can be indicators of supply chain compromise.
Detects phishing emails associated with the TONResolver campaign that impersonate Booking.com guest complaints. The rule identifies suspicious emails containing .ics calendar file attachments or links to domains matching the pattern 'photo-[0-9]+.cfd', primarily targeting hospitality staff with subject lines related to hotel inquiries or issues.
Detects instances where a browser or email client spawns a PowerShell process containing common obfuscated command-line arguments (e.g., -enc, IEX, bypass), which then subsequently executes node.exe or wscript.exe. This pattern is characteristic of the TONResolver infection chain, where a phishing lure triggers initial code execution via browser or email client to deploy a JavaScript-based RAT.
Detects phishing emails impersonating Booking.com, specifically targeting Japanese users with malicious .cfd domains, suspicious subject lines, or attachments like 'invite.ics'. The rule assigns risk scores based on specific indicators such as URL patterns, body text, and sender domains.
This rule correlates process execution patterns to detect a potential malicious document or file download chain. It monitors for child processes spawned by common document viewers (Adobe Acrobat, Word, Excel, PowerPoint) or browsers (Edge, Chrome, Firefox) that subsequently launch suspicious interpreters (cmd, powershell, wscript) or tools (7z, rar), finally leading to potentially malicious payload execution within common user-writable directories, or obfuscated PowerShell command-line execution.
This rule detects potentially malicious search queries within Microsoft 365 network traffic. It monitors HTTP headers and request bodies for search parameters that contain common web injection markers, such as script, img, or svg tags, and other suspicious keywords indicative of attempted Cross-Site Scripting (XSS) or search-based exploitation.
Detects endpoint file creation or modification events involving PDF files with suspicious, lure-like filenames (e.g., 'Settlement Agreement') being written by email clients or web browsers. This rule acts as a proxy for identifying potential spearphishing attachment execution on the endpoint.
Detects spearphishing emails delivered through Google Workspace infrastructure that fail DMARC strict alignment check. Specifically, this monitors instances where the DKIM signing domain is a gappssmtp.com subdomain that fails alignment with the envelope sender domain, while concurrently carrying a PDF attachment, consistent with known phishing campaign patterns.
This rule detects potential email spoofing or relay abuse by identifying emails that claim to be from the 'gasparinutrition.com' domain but fail DMARC authentication, despite showing a DKIM pass status specifically associated with 'gappssmtp.com' subdomains. This behavior is indicative of an adversary attempting to bypass email authentication mechanisms by leveraging legitimate third-party mail relay infrastructure to send spoofed messages.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects potential Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI injection patterns in web request headers, process command lines, and syslog messages. It further identifies suspicious outbound network callbacks to known malicious infrastructure associated with these exploitation attempts.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects the post-download execution stage of the abdrizak PostCSS typosquatting Windows RAT campaign. Covers three indicators: (1) wscript.exe executing a .vbs file from %TEMP% or subdirectory (e.g. update.vbs from winPatch), (2) chost.exe or any process launching loader.py as a command-line argument, (3) cmd.exe using tar to extract a .zip archive from %TEMP%.
This rule monitors incoming email events for a specific domain or sender address, detecting instances where emails pass DKIM validation but fail DMARC and SPF checks while simultaneously being flagged as spam by the email security solution. This pattern is indicative of potential spoofing or unauthorized email activity.
Page 47 of 235