Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
37
17
7
2
2
Contributors
16
14
10
7
3
Categories
19
15
14
13
10
Platforms
39,908
7,245
6,529
3,864
3,627
66
Products / Services
16
8
8
7
6
MITRE Techniques
17
14
9
9
7
IDS Classtypes
4
3
IDS Protocols
5
2
Detects network requests originating from mobile device user-agents to suspected phishing or OAuth-consent URLs. This rule identifies patterns common in 'quishing' (QR-code phishing) campaigns where a mobile device is used to interact with a malicious redirect chain or credential-harvesting page. It excludes known legitimate OAuth authorization flows to reduce noise.
This rule detects potential 'Quishing' (QR code phishing) attempts by identifying email-based phishing detection or malicious URL indicators followed by a user clicking the URL and subsequently authenticating to a corporate system from a mobile device (Android or iOS) within a 30-minute window. This behavior often suggests an adversary successfully harvesting credentials via a QR code link and then using them to gain unauthorized access.
This rule detects a multi-stage phishing attack, often referred to as 'quishing'. It identifies incoming emails containing image (JPG, PNG) or PDF attachments that embed previously unseen URLs, correlated with a subsequent sign-in event from a mobile device by the same recipient, which is a common indicator of Adversary-in-the-Middle (AiTM) credential harvesting.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
Detects the delivery of .mobileconfig files or related configuration profile types (e.g., .plist, .xml) via email. These profiles are used on macOS and iOS devices to modify system settings, such as mail, calendar, or contact synchronization, and can be used to install malicious root certificates to enable Man-in-the-Middle (MITM) attacks. This rule accounts for direct attachments as well as those concealed within zip archives.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
Detects execution or file drop of the GHOSTBLADE keychain-dumping module (keychain_copier.js) or its parent implant (ghostblade.js) on a device following DarkSword iOS exploit-chain compromise.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
This rule identifies if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a public GitHub repository and then checks if a specified IP address is contained within any of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
This rule identifies if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a public GitHub repository and then checks if a specified IP address is contained within any of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
This rule checks if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a GitHub repository and then uses KQL's `ipv4_is_in_any_range` and `ipv6_is_in_any_range` functions to determine if the provided IP address is part of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
This rule identifies if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It leverages an external CSV file containing these IP ranges for both IPv4 and IPv6. This can be used to detect or monitor traffic potentially obfuscated by iCloud Private Relay.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
This rule detects an unusual pattern of multiple login attempts from several unique devices using Windows Hello for Business within a short timeframe (5 minutes) for a single user. This could indicate an MFA bypass attempt or a compromised account where an adversary is attempting to gain access from various devices.
This rule detects an unusual pattern of multiple login attempts from several unique devices using Windows Hello for Business within a short timeframe (5 minutes) for a single user. This could indicate an MFA bypass attempt or a compromised account where an adversary is attempting to gain access from various devices.
Detects potential SMS phishing (smishing) vectors involving a specific shortened URL used to deliver mobile surveillance and exfiltration malware, specifically the fake RedAlert application.
Page 2 of 4