Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
165
46
37
9
9
Contributors
60
46
36
25
20
Categories
101
78
76
66
59
Platforms
144
61
58
22
17
Products / Services
81
66
44
38
32
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
3
1
IDS Classtypes
34
7
4
1
IDS Protocols
38
5
1
1
Detects the execution of PowerShell with suspicious command-line arguments (hidden window, no profile, or encoded commands) spawned directly from a web browser process (e.g., Chrome, Edge, Firefox, Explorer). This behavior is characteristic of ClickFix-style social engineering attacks where a user is tricked into copying and executing malicious PowerShell commands via the Win+R Run dialog or terminal.
Detects a suspicious sequence where Microsoft Outlook launches Microsoft Edge to open a URL, and that browser process subsequently makes network connections to infrastructure associated with the ClickFix phishing campaign (e.g., rsvpopenh.one or specific malicious IP).
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing messages that deliberately mix writing systems/scripts/homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. Hardened against false positives: brand/product tokens (e.g. Microsoft, PayPal) are stripped before the Latin-script check so a lone brand mention in non-Latin correspondence doesn't count as mixed-script; the suspicious-URL signal requires a high-confidence credential/urgency term (not generic business vocabulary); sender risk requires the domain to be new to both the recipient and the organization; and at least three independent signal categories (not two) must corroborate the language-confusion signal before the rule fires.
Detects a suspicious sequence of user activity where a device visits a social media platform (Twitter/X) followed shortly by navigation to a Google Doc. This pattern is often consistent with phishing lures where victims are enticed via direct messages or social engineering to open a malicious document hosted on Google Docs.
Detects execution chains where explorer.exe (acting as the Run dialog host) spawns suspicious processes like mshta.exe, powershell.exe, or cmd.exe with command lines containing URL indicators (http), common payload filenames (rtdx.dat), or specific IP address strings associated with known ClickFix social-engineering campaigns.
Detects instances where a browser process (Chrome, Edge, Firefox, or IE) programmatically writes content to the system clipboard using JavaScript commands. This pattern is commonly observed in 'ClickFix' style social engineering attacks, where a user is coerced into copying and executing a malicious command script provided by an attacker, often in the context of resolving a fake system error.
This rule detects potential 'Quishing' (QR code phishing) attempts by identifying email-based phishing detection or malicious URL indicators followed by a user clicking the URL and subsequently authenticating to a corporate system from a mobile device (Android or iOS) within a 30-minute window. This behavior often suggests an adversary successfully harvesting credentials via a QR code link and then using them to gain unauthorized access.
Detects macOS Terminal commands that involve decoding a base64 string and piping the output directly to bash. This behavior is characteristic of 'ClickFix' social engineering campaigns, where users are lured into pasting a malicious command into their terminal, often under the guise of fake 'reCAPTCHA' or 'bot-verification' instructions.
This rule identifies potential Apple iCloud phishing attempts by monitoring web proxy logs for requests containing specific indicators of a spoofed 'Find My' page. It specifically looks for URLs that include '/help?' combined with keywords like 'Find Devices', 'Geräte finden', 'icloud', or 'findmy', which are common markers for malicious phishing landing pages attempting to harvest user credentials.
Detects HTTP requests directed to the Vapi.ai API from potential phishing panels or malicious infrastructure. This behavior is indicative of an attacker leveraging Vapi.ai's conversational AI services to conduct automated voice phishing (vishing) campaigns by initiating calls or managing AI assistants.
This rule detects anomalous OAuth authorization requests to Microsoft and Google services where the 'redirect_uri' parameter points to suspicious external domains (specifically ending in .vu) or, in the case of silent Microsoft OAuth requests, points to domains outside of recognized Microsoft/Office 365 infrastructure. Such abuse is often indicative of OAuth consent phishing campaigns designed to steal application access tokens.
This rule detects a two-stage network redirect sequence indicative of an Adversary-in-the-Middle (AiTM) phishing campaign. The first stage identifies traffic interacting with a Google Ads click-tracker, and the second stage identifies a subsequent request to an AWS S3 bucket, often used to host malicious landing pages or phishing proxies.
This rule set detects multi-stage network patterns indicative of AiTM phishing campaigns. It identifies common redirection techniques, including lookalike domains hosting Microsoft OAuth authorize URLs, DNS resolution of Google ad-tech infrastructure followed by novel domains, malicious use of Google Meet and Google Ads click-tracking endpoints as phishing hops, and references to AWS S3-hosted intermediate landing pages.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing activity by correlating network requests to known malicious lure domains with help-desk or vishing-themed events (such as password resets or unsolicited IT support) for the same user within a one-hour window. This behavior is indicative of a help-desk impersonation campaign where attackers direct users to credential harvesting sites.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
Detects execution chains where explorer.exe (acting as the Run dialog host) spawns suspicious processes like mshta.exe, powershell.exe, or cmd.exe with command lines containing URL indicators (http), common payload filenames (rtdx.dat), or specific IP address strings associated with known ClickFix social-engineering campaigns.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Page 4 of 14