Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,932
7,263
6,535
3,865
3,643
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects inbound emails associated with the Latin-placeholder PDF phishing campaign. The detection triggers based on a high spam confidence level (SCL >= 5), a spam verdict, authentication failures (SPF softfail/fail and DMARC fail), and the presence of a PDF attachment.
This rule monitors for incoming emails that pass DKIM authentication but fail DMARC verification, specifically where the signing domain is associated with Google Apps (gappssmtp.com). This pattern is often indicative of email spoofing, where an attacker sends mail from a legitimate provider's infrastructure but fails the domain alignment requirements of DMARC.
Detects suspicious patterns within the search query parameters of Microsoft Copilot and M365 search requests, indicative of potential prompt injection, data exfiltration, or exploitation attempts through malicious URL parameters.
Detects incoming emails with specific subject lines or attachment names relating to 'distribution settlement agreement' or 'agreement settlement' that arrive as PDF attachments. The rule calculates a risk score based on sender domain reputation (known malicious), DMARC/DKIM authentication mismatches, and potential display name spoofing to identify phishing attempts.
Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. This rule specifically looks for instances where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' while the 'SenderMailFromDomain' (P1 envelope) is different, indicating an attempt to spoof the sender's domain.
Detects incoming emails that claim to be from a 'Monitoring' display name associated with the gasparinutrition.com domain or specific accounting sender address, which may indicate a spearphishing or impersonation attempt.
This rule identifies emails originating from or claiming to be from the domain 'gasparinutrition.com' or the specific address 'accounting2@gasparinutrition.com' while using the display name 'Monitoring'. This is a common pattern observed in phishing or social engineering campaigns where adversaries impersonate internal or trusted organizational functions.
Detects incoming email messages containing PDF attachments from 'gasparinutrition.com' that either have suspicious filenames indicating legal or contractual documents or contain external links redirecting to non-domain URLs. These indicators are consistent with credential harvesting or phishing campaigns.
Detects phishing emails where the sender domain (gasparinutrition.com) is spoofed or compromised. The emails are routed through Google Workspace infrastructure (gappssmtp.com) which results in a DMARC alignment failure under strict policies (adkim=s; aspf=s). The rule specifically flags emails containing PDF attachments with subject lines related to distribution, settlement, or agreements.
Detects cloud searches for credential, key, production, database, or confidential terms followed by access to matching files within OneDrive.
Detects outbound email from an organizational mailbox to a common consumer email provider with multiple or large attachments. This could indicate data exfiltration or unauthorized transfer of sensitive information.
Detects a mismatched/synthetic iOS 18 User-Agent (Version/26.x) used by Kali365 to bypass detection. This specific User-Agent string is indicative of malicious activity as 'Version/26' does not natively exist on iOS 18.
Detects first-time external sender domains delivering multiple voicemail-themed or financial urgency emails to the same recipient during off-hours (midnight-06:00 UTC), consistent with Scotiabank TOAD callback phishing targeting CFO/finance executives.
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Detects the attacker leveraging a stolen session token to create or modify inbox rules that move finance or payroll related emails to the Archive or Trash folders, or delete them, as observed in Tycoon2FA phishing campaigns.
Identifies emails with low text content but containing image attachments (.png/.jpg) associated with QR code "Quishing" attacks, a rising Q1 trend. The rule specifically looks for image attachments with filenames containing keywords like 'scan', 'qr', 'barcode', 'auth', or 'mfa', and joins this with email events that have no URLs, indicating the QR code is the primary call to action.
Detects application consent by a user shortly after the same account clicked a code-of-conduct or compliance-themed message. This behavior can indicate a multi-stage phishing campaign where a user is lured into clicking a malicious link (e.g., a fake policy document) and subsequently grants OAuth permissions to a malicious application.
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Detects a mail forwarding or redirect rule created from a session that recently exhibited token replay or unusual client changes. This rule specifically looks for operations related to Inbox Rules in Exchange or Office 365 audit logs that contain keywords indicating forwarding or redirection.
Detects the creation or modification of Named Locations within Conditional Access policies that include IP ranges. This behavior could indicate an attacker whitelisting their own IP addresses to maintain persistence or bypass Conditional Access security controls. The rule correlates changes with administrative context, such as non-standard business hours, weekends, or modifications by unexpected accounts.
Page 103 of 150