Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
9
7
1
1
Contributors
6
3
3
3
1
Categories
6
5
5
3
2
Platforms
7
4
3
2
1
Products / Services
7
5
3
2
1
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
IDS Classtypes
5
2
IDS Protocols
7
Detects incoming HTTP GET requests targeting known API endpoints associated with the GhostCode phishing kit. These endpoints (/api/harvester) are used by the phishing kit to poll for session details, device codes, or flow identifiers, characteristic of credential harvesting operations.
This KQL detects potential social engineering and vishing activity in Microsoft Teams over the last 30 days.
This KQL identifies inbound emails that were not blocked and have subject lines commonly associated with phishing or social engineering lures along with a URL and/or attachment
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects endpoint file artifacts associated with known malicious browser extension IDs in browser extension storage paths, indicating possible installation or presence of malicious browser extensions.
Detects HTTP POST requests directed at known Kratos Phishing-as-a-Service (PhaaS) URI paths, specifically 'PTT', 'SOft', or 'mini.php'. These paths are commonly associated with credential exfiltration activities.
Detects HTTP POST requests indicative of credential exfiltration associated with the Kratos phishing kit. The rule monitors for specific endpoint patterns (e.g., next.php, nex.php, n3xt.php, or officers*eur.php) commonly utilized by this kit to receive stolen credentials.
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
This rule detects HTTP POST requests containing common credential field names directed at files ending in .php (such as login.php, result.php, or index.php), which is highly characteristic of phishing kits used to harvest credentials.
Detects JavaScript keyloggers capturing form field input on web pages
Detects files or processes matching SHA256 indicators published by Google Threat Intelligence Group for the INFINITERED campaign. The hashes cover the help.php persistence component, credential harvesters, backdoors, and droppers. A match should be treated as a high-confidence indicator of compromise and investigated immediately.
Detects unique INFINITERED marker strings in process command lines or event metadata. The indicators include the upgrade-code GUID delimiter, its Base64 representation, the stolen-session identifier prefix, and the custom file-download command tag. These values are specific to the reported malware and should be treated as high-confidence evidence when present.
This rule correlates the modification of 'Upgrade.php' with subsequent changes to REDCap authentication, login, or hook-related PHP files on the same device within a 30-minute window. This activity is indicative of the INFINITERED threat actor's technique to intercept the REDCap upgrade process and reinject credential harvesting, backdoor, and persistence code into new software versions. Such a sequence should be compared with approved maintenance windows and expected deployment activity to identify malicious behavior.
This rule detects JavaScript code being delivered to a client that attempts to capture form field data, specifically looking for 'document.querySelector', 'password', and 'fetch(' within HTTP response data. This behavior is indicative of an attempt to exfiltrate credentials from a login page.
This rule detects the presence of a web portal login page skimmer script by looking for specific JavaScript keywords within HTTP response data. It specifically searches for the combination of 'addEventListener', 'keydown', and 'XMLHttpRequest' (case-insensitive) in the data flowing from the server to the client. This combination suggests a script designed to capture user input (like keystrokes) and exfiltrate it via XMLHttpRequest, a common technique used by web skimmers to steal credentials.
Detects phishing emails with malicious HTML attachments designed to harvest credentials and exfiltrate them via the Telegram Bot API. The detection looks for specific attachment filenames (e.g., RFQ, INQUIRY) or content patterns indicative of this threat.
'Access attempts to Azure Portal from an unauthorized user. Either invalid password or the user account does not exist.'
