Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects activity related to specific known fabricated news infrastructure domains and associated social media handles, which are indicative of influence operations. It monitors network connection events, email URL clicks, email communication patterns involving these domains, and process executions that reference these specific accounts or handles.
This rule monitors for network and email activity associated with known fraudulent AI reseller infrastructure. It aggregates data from device network connections, email URL inspections, and email header analysis to identify potential interactions with malicious domains known to facilitate AI-related fraud.
This rule identifies emails containing URLs associated with known suspicious or malicious domains (secboxes.com, msbenefit.com, attcdn.com, brianwilli.com). It filters for instances where the sender's domain is not one of the identified suspicious domains to reduce noise from potential email spoofing or miscategorized communications, flagging potential phishing attempts.
Detects network requests to the Microsoft authentication service specifically targeting the /common/oauth2/deviceauth endpoint, which is used in the OAuth 2.0 Device Authorization Grant flow. While legitimate for device authentication (e.g., CLI tools, smart devices), this flow can be abused by adversaries for phishing attacks to bypass traditional credential-based MFA, allowing them to gain persistent access to a user account once the target authorizes the code.
This rule detects potential API abuse by identifying high-frequency API calls using the 'python-requests' user agent that occur within a short time window (120 seconds) immediately following a successful device code authentication event. This behavior is indicative of automated token theft or session hijacking where an adversary attempts to perform unauthorized actions quickly using tokens obtained via device code phishing.
Detects successful Microsoft Intune enrollment events initiated using the Device Code authentication protocol in Azure AD/Entra ID. This flow is often abused by adversaries to perform OAuth device code phishing, allowing them to gain unauthorized access to cloud resources by tricking users into authorizing a malicious application on their own devices.
Detects HTML phishing lures associated with the GhostCode kit, which utilizes obfuscation techniques such as zero-font-size <ins> tags and injected HTML comments between characters to bypass static and NLP-based security analysis.
Detects phishing emails impersonating 'Veltrix Capital' that lure developers into running, debugging, or cloning repositories, often disguised as technical assessment or job-related tasks involving cryptocurrency or blockchain themes.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects instances where a service principal or entity identified as an AI agent, bot, or assistant accesses files in SharePoint or OneDrive that are likely to contain sensitive credentials, secrets, or configuration files (e.g., .pem, .pfx, .env, id_rsa).
Detects downstream delivery of likely AI-paraphrased mass-produced lure content by identifying bursts of near-duplicate subject lines from newly-seen domains with auth failures.
Detects downstream delivery of likely AI-paraphrased mass-produced lure content by identifying bursts of near-duplicate subject lines from newly-seen domains with auth failures.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
This rule detects email or web proxy traffic containing a lure themed around 'Confluence', combined with a redirect or link to Telegram, and specifically containing Cyrillic character sets. This combination is often indicative of targeted phishing campaigns using social engineering lures to redirect users to external messaging platforms for further interaction or credential harvesting.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects signs of the TrustSink technique where an Entra sign-in process, while at the MFA stage, is intercepted by redirecting the user to a rogue External Authentication Method (EAM) provider. This unauthorized provider typically uses look-alike domains or tunneling services to host phishing pages that harvest plaintext credentials and return forged MFA tokens to Entra.
Page 55 of 179