Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects inbound emails originating from external, non-corporate domains that impersonate an internal executive's display name. The rule flags messages containing common Business Email Compromise (BEC) urgency or confidentiality triggers such as 'wire transfer', 'urgent', 'NDA', or 'private email'.
Detects inbound emails originating from external, non-corporate domains that impersonate an internal executive's display name. The rule flags messages containing common Business Email Compromise (BEC) urgency or confidentiality triggers such as 'wire transfer', 'urgent', 'NDA', or 'private email'.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
This rule identifies phishing attempts by detecting inbound emails where the sender's domain or any embedded URLs within the email content match a pre-defined list of known malicious domains. It flags emails for further investigation by correlating sender domain data and URL information found in the email communication.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
Detects incoming emails that impersonate DocuSign notifications, specifically looking for typical phishing lures involving 'Remittance Advice' and a call-to-action to 'Tap here to view document'. This rule identifies emails using common social engineering tactics to harvest credentials or distribute malware via fake document links.
This rule identifies suspicious emails containing password-protected attachments or files often used to bypass email security gateways. It monitors for emails where the subject line includes password hints or keywords like 'protected' or 'secure', combined with the presence of attachments and URL-based links, which are common tactics in phishing campaigns to distribute malicious payloads.
This rule detects potential phishing activity by identifying bulk email campaigns (5 or more recipients) where either the email subject contains known suspicious keywords (e.g., 'password', 'urgent', 'invoice') or the Reply-To address domain differs from the sender domain. The rule specifically excludes emails with attachments or URLs, focusing on social engineering pretexts that aim to initiate a conversation or gather information without external payloads.
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects cloud application events originating from suspicious or specific User-Agent strings, including 'python-requests' and identified outdated or potentially spoofed Chrome versions (146, 150, 151.0.0). This behavior often correlates with automated scripts or bot activity interacting with cloud services.
Detects cloud application events originating from suspicious or specific User-Agent strings, including 'python-requests' and identified outdated or potentially spoofed Chrome versions (146, 150, 151.0.0). This behavior often correlates with automated scripts or bot activity interacting with cloud services.
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
Detects cloud application events originating from suspicious or specific User-Agent strings, including 'python-requests' and identified outdated or potentially spoofed Chrome versions (146, 150, 151.0.0). This behavior often correlates with automated scripts or bot activity interacting with cloud services.
Detects anomalous, high-volume access to email items or attachments in Microsoft Exchange Online by a single account from a single IP address, which may indicate account compromise, unauthorized mail harvesting, or data exfiltration.
Detects anomalous user behavior where a file search query is followed by a high volume of file downloads within a short period (30 minutes) from the same IP address. This behavior is indicative of an attacker searching for sensitive documents and performing bulk extraction or exfiltration.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects inbound emails associated with the Mirage phishing campaign. The detection monitors for known malicious domains in sender information and URL links, as well as specific command-and-control (C2) IP addresses and URL patterns.
Page 81 of 179