Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
5
Contributors
5
Categories
2
2
1
1
1
Platforms
3
2
1
1
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
2
1
1
Detects DNS resolution, network connections, or email-embedded URLs matching known JWR phishing framework hosting domains and IP addresses, including banking/government/logistics brand-impersonation lookalikes and smishing-delivered typosquats.
Detects a credential-phishing email linking to a spoofed Microsoft device-code login flow (deviceaddcredential.srf) from a sender/recipient domain mismatch, or delivery of the associated known malicious attachment hash.
Detects spearphishing email impersonating the CSIS 'Indo-Pacific Forecast 2026' invitation-only event lure, gated on CSIS branding/display name combined with a sender domain that does not match csis.org.
Detects contact with the OnyxC2 lure landing page performing canvas fingerprinting (multiboardthe.com) correlated with a subsequent registry write from the known dropper process, tying victim-vetting to the OnyxC2 install chain.
Detects phishing emails impersonating AI/LLM service providers that reference API keys or developer consoles and contain embedded URLs to login/signin/auth/console pages, consistent with token-jacking campaigns harvesting developer credentials.