Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,931
7,261
6,535
3,864
3,642
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule identifies external domains sending a high number of unique links in Microsoft Teams messages over the last 7 days, excluding common trusted Microsoft domains. It aims to detect potential phishing attempts or unusual external communication patterns that might indicate malicious activity or data exfiltration.
This rule detects messages within Microsoft Teams that have been identified by Microsoft Defender for Office 365 as containing phishing attempts, malware, or spam. It specifically looks for messages with 'Phish', 'Malware', or 'Spam' verdicts in the ThreatTypes field, allowing for quick identification and triage of malicious content.
Detects programmatic token refresh activity using the BAV2ROPC user agent originating from Railway IP space. This indicates automated persistent token cycling mechanisms used by the EvilTokens Phishing-as-a-Service (PhaaS) campaign to maintain access to compromised Microsoft 365 accounts.
This rule analyzes URL click events within Microsoft Teams to identify and summarize actions taken on URLs, specifically focusing on Safe Links outcomes. It helps in understanding user interaction with links, potentially identifying malicious link clicks that Safe Links has intercepted or allowed, and assessing the adoption of Safe Links protection within the Teams environment.
This detection will help to detect on mass device wipe events within Intune. This is based on the previous breach of Stryker. This will help to determine if a device wipe attack is taking place within your environment.
This rule identifies instances where users have clicked on URLs within Microsoft Teams. It specifically filters for 'UrlClickEvents' where the 'Workload' is 'Teams' and provides details such as the timestamp, user principal name, URL, URL domain, action type, and network message ID. This can be used to investigate potential phishing attempts or malicious link clicks within the Teams environment.
This rule detects instances where a user clicks on a URL in an email, and the final redirected URL is hosted on 'workers.dev', which is often abused for phishing campaigns, particularly OAuth device code phishing. It correlates email delivery events with URL click events and analyzes the full redirect chain to identify the final destination.
This rule detects inbound emails with an SVG attachment that is disguised as an HTML file and contains a long, base64-like string in its filename. This pattern is often used in phishing campaigns to bypass traditional email filters and deliver malicious content, potentially leading to credential harvesting or malware delivery. The rule specifically looks for files with a '.svg' extension but a 'html' file type, combined with a filename containing a string of at least 20 alphanumeric characters, plus or minus, equal signs, which is characteristic of base64 encoding.
This analytic query detects potential phishing compromise activity by correlating URL click events from Defender for Office 365 with Sign-in device code authentication logs.
This rule detects emails containing a specific URL (https://openclaw.ai/install.ps1) which is known to host a PowerShell script. This indicates a potential attempt to deliver malicious code via email, likely as part of a phishing campaign to execute the script on the recipient's system.
This detection identifies instances where a user has clicked on a URL within an email and has actively bypassed a security warning page. This behavior is a strong indicator of a successful phishing lure or high-risk user action, as the user has ignored a direct warning about the potential danger of the destination link.
This rule detects network connections or email URLs that contain domains associated with the 'ShinyHunters' threat group's infrastructure. The rule specifically looks for a predefined list of domains known to be used by ShinyHunters for phishing or other malicious activities. It correlates email URL information with device network events to identify potential compromise attempts.
This rule detects several types of suspicious activities related to Microsoft Graph API calls, specifically targeting device management actions. It identifies: 1. Actions from an IP address not previously seen for a given caller identity. 2. Actions performed by a service principal that has not been observed before. 3. High-risk actions (e.g., device wipe, retire, remote lock, reset passcode) or device configuration changes occurring outside of business hours or on weekends. 4. Bulk device targeting, where a single caller identity performs actions on a large number of devices within a short time frame. These detections aim to identify potential compromise of accounts or malicious administrative actions.
Attackers take advantage of the emojis because they help the content stand out and gets more attention than plain text. It not apply just to Email Subject if not that it also applies to Attachment Files which based on my experience, legitime file not use to have icons in their file names.For example:
📄Invoice.pdf
🔐Reset_Password.html
📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on emails
- Files downloaded from phishing emails
- User-downloaded /opening scam files
- Payloads with social engineering names
📄Invoice.pdf
🔐Reset_Password.html
📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on emails
- Files downloaded from phishing emails
- User-downloaded /opening scam files
- Payloads with social engineering names
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Detects incoming emails where a single URL contains indicators of two or more distinct security vendor rewriting services. This technique is used by adversaries to create multi-layered redirect chains to bypass automated scanners and deliver malicious content, as seen in Tycoon2FA and Sneaky2FA campaigns.
This rule detects suspicious activity where a new device is registered after a user browse or click on a Microsoft device login page. This could indicate an adversary attempting to register a new device to bypass multi-factor authentication or establish persistence.
Marketing emails use Emojis all the time… but attackers use them too because they catch attention and increase the chance someone clicks:
- ⚠️ Urgent messages
- 📦 Delivery notifications
- 📄 Fake invoices
- 🔐 Password resets
Identify and classify cases on Email Subjects can be converted in useful detections. It query identify:
- Emails received with icons in the subject
- Where the URL was clicked
- Excluding cases where the sender is added as allowed either in the organization or user level
- Summarise by number of Emails, number of distinct recipients and also identify if the messages were delivered into Inbox Folders
- ⚠️ Urgent messages
- 📦 Delivery notifications
- 📄 Fake invoices
- 🔐 Password resets
Identify and classify cases on Email Subjects can be converted in useful detections. It query identify:
- Emails received with icons in the subject
- Where the URL was clicked
- Excluding cases where the sender is added as allowed either in the organization or user level
- Summarise by number of Emails, number of distinct recipients and also identify if the messages were delivered into Inbox Folders
This rule detects impossible travel scenarios for user sign-ins that occur shortly after a device associated with that user has been wiped, retired, or deleted. It calculates the speed between consecutive sign-in locations for the same user and flags any travel exceeding 900 km/h, indicating a potential compromise or fraudulent activity.
This rule correlates an email URL click with a subsequent risky sign-in from the same user within a short timeframe (1 hour). This is a strong indicator of a successful Adversary-in-the-Middle (AiTM) phishing attack, such as those conducted with the Tycoon2FA kit, where a user is tricked into authenticating through a malicious site, allowing the attacker to capture their session.
Page 115 of 150