Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,865
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects an inbound policy-themed PDF attachment whose extracted URLs lead to a sign-in, authentication, review, or acknowledgement workflow outside the organisation. This rule specifically looks for PDF attachments in emails where the subject contains terms like 'code of conduct', 'policy', 'compliance', or 'handbook', and the extracted URLs within the PDF contain keywords such as 'login', 'signin', 'auth', 'review', or 'acknowledge'.
Detects email-based phishing attempts impersonating Scotiabank where the sender display name contains 'Scotiabank' but the actual sending domain is not 'scotiabank.com'. The rule specifically looks for emails with SPF and DMARC pass but missing DKIM pass, combined with suspicious subject lines (e.g., 'interac', 'e-transfer', 'unauthorized') or specific IP addresses/GoDaddy infrastructure indicators, and targeting high-value recipients (CFO, finance, etc.). This pattern is consistent with compromised legitimate small-business domain abuse.
Identifies python-requests User-Agent authenticating into Office/Graph applications, indicative of Kali365 backend egress.
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
Detects application consent by a user shortly after the same account clicked a code-of-conduct or compliance-themed message. This behavior can indicate a multi-stage phishing campaign where a user is lured into clicking a malicious link (e.g., a fake policy document) and subsequently grants OAuth permissions to a malicious application.
Detects phishing emails leveraging Telephone-Oriented Attack Delivery (TOAD). These emails impersonate Scotiabank and use urgent themes regarding unauthorized $3,000 Interac e-Transfers to lure victims into calling an attacker-controlled toll-free number. The rule monitors for specific email subjects and attachments masquerading as voicemail audio files (v-mail*.mp3.eml or v-mail*.html).
Detects bulk reconnaissance against multiple Microsoft Graph API endpoints (users, groups, roles, etc.) by scripting clients, correlated with a recent device registration event by the same user principal. This behavior is indicative of a Storm-2372 conditional access bypass strategy followed by rapid directory environment enumeration.
This rule detects potentially malicious emails that leverage Calendly as a lure. It looks for emails that pass standard authentication (SPF/DKIM/DMARC) but contain suspicious elements such as URLs redirecting to Calendly or Google, subject lines related to common social engineering themes (complaints, health inspections, etc.), or the presence of ZIP attachments that match common photo/image naming patterns.
This rule detects suspicious emails exhibiting patterns associated with 'authentication laundering' by identifying the combination of legitimate scheduling or redirection links (e.g., Calendly, Google Redirect) with potentially malicious indicators such as zip file links, suspicious .cfd domains, or impersonation of booking management services. It calculates a laundering score based on these features and the health of email authentication signals (SPF/DKIM).
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies specific malicious attachment filenames, suspicious URLs, subject lines, and sender domains commonly used in these campaigns to deliver malicious content.
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
Detects registration of new MFA devices potentially for authentication bypass
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824).
Detects emails containing Microsoft Customer Voice URLs that redirect to known cloud-hosting platforms (vercel.app, amplifyapp.com, workers.dev) frequently used for phishing campaigns. This indicates an attempt to leverage legitimate Microsoft services to host or redirect to malicious content.
Identifies inbound emails leveraging the HR-themed "Code of Conduct" or "Employee Policy" subjects often used to trigger the AiTM campaign.
Detects a single new session identifier accessing Exchange, SharePoint, and OneDrive within a short period, which may indicate broad post-authentication collection following an adversary-in-the-middle (AiTM) attack.
Detects a rapid burst of file upload activity to cloud storage applications from a single account, including unusual proxy or device context. This rule identifies scenarios where an account performs 20 or more upload events or uploads 20 or more distinct objects within a 15-minute time window to common cloud storage services like Google Drive, Dropbox, Box, MEGA, OneDrive, or ShareFile. It also highlights if any of these uploads originate from an anonymous proxy.
Detects a newly replayed session issuing mailbox searches for invoice, payment, password, security, or confidential terms. This rule is designed to identify suspicious activity indicative of session hijacking or credential compromise, where an attacker uses a replayed session to search for sensitive information within a mailbox or SharePoint.
Detects attempts to modify or delete Conditional Access Policies in Microsoft Graph. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
This rule monitors for suspicious emails involving the 'gasparinutrition.com' domain, specifically looking for indicators such as DMARC failures, spoofed display names (e.g., 'monitoring'), or attachments with file names related to business documents like distribution, settlement, or agreements. It also triggers on DNS queries for the same domain, which could indicate related outbound communications or C2 activity.
Detects inbound emails from external domains that leverage generic automated sender display names (e.g., 'DocuSign', 'No-Reply') and deliver PDF attachments with lure filenames commonly associated with document-based phishing campaigns (e.g., 'Agreement', 'Settlement'). The rule specifically monitors for these indicators when the subject line also contains executive-level keywords, indicating a targeted phishing attempt against C-Suite personnel.
Page 102 of 150