Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects a multi-stage phishing pattern attributed to Star Blizzard (also known as Callisto Group or COLDRIVER). The attack involves an initial email containing no attachments to establish trust or initiate a thread, followed by a subsequent reply-thread email containing both an archive file (ZIP/RAR) and an image file. This technique is designed to bypass email security scanners by hiding the archive password within the image attachment or obscuring the malicious payload context.
This rule detects incoming phishing emails that use specific financial or payment-related lures (e.g., 'eft wire transfer', 'invoice receipt') in the subject line or body to entice users into clicking a link that points directly to an executable file, often disguised as a document.
This rule detects incoming phishing emails that use specific financial or payment-related lures (e.g., 'eft wire transfer', 'invoice receipt') in the subject line or body to entice users into clicking a link that points directly to an executable file, often disguised as a document.
This rule detects incoming phishing emails that use specific financial or payment-related lures (e.g., 'eft wire transfer', 'invoice receipt') in the subject line or body to entice users into clicking a link that points directly to an executable file, often disguised as a document.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Detects the modification of critical Entra ID authentication method policies, such as the registration or configuration of external MFA/OIDC providers, by a user account shortly after an anomalous or high-risk login event. This behavior is indicative of an attacker attempting to establish persistent backdoor access via rogue MFA provider registration, consistent with techniques used to subvert cloud authentication policies.
Detects inbound email or ticketing messages containing extortion language (such as payment deadlines, leak-site references, and data-shredding threats) specifically directed at high-value internal targets like executives, security teams, and legal departments. This pattern is consistent with the ShinyHunters 'pay-or-leak' extortion model.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; a weighted score (script-mixing=2, homoglyph=3, high-confidence phishing vocabulary=2, threshold=6) means no two of the three signal categories can reach the threshold alone — all three must co-occur before the rule fires.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; a weighted score (script-mixing=2, homoglyph=3, high-confidence phishing vocabulary=2, threshold=6) means no two of the three signal categories can reach the threshold alone — all three must co-occur before the rule fires.
Detects phishing messages that mix writing systems/scripts/homoglyphs in the Subject line as one corroborating signal within a broader, multi-signal phishing pattern.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; a weighted score (script-mixing=2, homoglyph=3, high-confidence phishing vocabulary=2, threshold=6) means no two of the three signal categories can reach the threshold alone — all three must co-occur before the rule fires.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; a weighted score (script-mixing=2, homoglyph=3, high-confidence phishing vocabulary=2, threshold=6) means no two of the three signal categories can reach the threshold alone — all three must co-occur before the rule fires.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; a weighted score (script-mixing=2, homoglyph=3, high-confidence phishing vocabulary=2, threshold=6) means no two of the three signal categories can reach the threshold alone — all three must co-occur before the rule fires.
Detects phishing emails that mix writing systems or scripts in the Subject line, combined with phishing vocabulary.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; the suspicious-URL signal requires a high-confidence credential/urgency term (not generic business vocabulary); sender risk requires the domain to be new to both the recipient and the organization; and at least three independent signal categories (not two) must corroborate the language-confusion signal before the rule fires.
This rule detects potential adversarial reconnaissance activities targeting AI agents via multiple communication channels (e.g., email, collaboration tools). It identifies patterns where a sender transmits messages containing common 'jailbreak' or 'instruction-override' phrases (e.g., 'ignore previous instructions', 'bypass approval') across at least three distinct channels within a 24-hour window, indicating a concerted effort to manipulate or probe agent logic.
This rule detects potential adversarial reconnaissance activities targeting AI agents via multiple communication channels (e.g., email, collaboration tools). It identifies patterns where a sender transmits messages containing common 'jailbreak' or 'instruction-override' phrases (e.g., 'ignore previous instructions', 'bypass approval') across at least three distinct channels within a 24-hour window, indicating a concerted effort to manipulate or probe agent logic.
This rule detects potential adversarial reconnaissance activities targeting AI agents via multiple communication channels (e.g., email, collaboration tools). It identifies patterns where a sender transmits messages containing common 'jailbreak' or 'instruction-override' phrases (e.g., 'ignore previous instructions', 'bypass approval') across at least three distinct channels within a 24-hour window, indicating a concerted effort to manipulate or probe agent logic.
This rule detects potential AI prompt injection attacks delivered via email. It identifies users clicking external links directed at AI platforms (like OpenAI, Claude, or Perplexity) that contain suspicious URL parameters or instructions designed to manipulate or override the AI's standard behavior. It correlates the web request with a subsequent process execution on the host that includes suspicious keywords in the command line, suggesting an attempt to automate or exploit the AI assistant through local system interaction.
This rule detects potential data exfiltration by correlating access to files labeled as sensitive (confidential, restricted, etc.) with a subsequent upload to a personal cloud storage provider or transmission via email to a personal domain within a two-hour window.
Page 18 of 179