Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
165
46
37
9
9
Contributors
60
46
36
25
20
Categories
101
78
76
66
59
Platforms
144
61
58
22
17
Products / Services
81
66
44
38
32
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
3
1
IDS Classtypes
34
7
4
1
IDS Protocols
38
5
1
1
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing TLDs, indicating potential phishing attempts or the use of Phishing-as-a-Service (PhaaS) infrastructure. The rule specifically targets one-on-one chats and filters for a broad list of suspicious top-level domains.
This rule detects network activity and email signals associated with a malicious campaign promoting a fraudulent 'Perplexity AI' Chrome extension. It monitors for connections to known malicious Tilda landing pages, correlates these visits with subsequent Google Chrome extension (CRX) downloads within a 10-minute window, and identifies phishing emails containing links to these malicious pages.
Detects user-initiated PowerShell execution patterns associated with Woodgnat social engineering campaigns (ClickFix, FileFix, CrashFix). The rule monitors for PowerShell processes spawned by common communication and web browsing applications (Microsoft Teams, Chrome, Edge, Firefox) or script interpreters (mshta, wscript) that utilize obfuscation or non-interactive flags common in these attack vectors.
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
This detection identifies a pattern associated with the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.
This rule detects potentially malicious web traffic involving a redirect chain associated with HolaBrief and LoopedIn services, which are sometimes leveraged in phishing campaigns or credential harvesting. It identifies multi-hop redirect chains and connections to known suspicious IP addresses (217.182.211.237).
Detects a browser creating a ZIP archive whose name impersonates a GPU, disk, temperature, codec, or PDF utility associated with high-performance systems. This activity is often associated with poisoned search results leading to cryptojacking campaigns.
Detects the presence of SVG files containing obfuscated JavaScript and redirection logic. This technique is used by phishing campaigns, such as Tykit, to redirect victims to malicious sites.
Detects the execution of VBScript files via wscript.exe or cscript.exe from user-writable directories (Temp, Downloads, AppData, etc.) when the process is spawned by common application vectors like web browsers, email clients, or document viewers. This behavior is indicative of the Grandoreiro banking trojan's dropper mechanism, which uses obfuscated VBS scripts for geofencing and locale checks prior to downloading secondary payloads.
Detects attempts to exploit the Windows Search URI handler vulnerability (CVE-2023-29357) which can lead to NTLM credential leaks. This rule specifically looks for process command lines that invoke the 'search' or 'search-ms' URI scheme with a 'crumb=location:' parameter pointing to an UNC path, indicating an attempt to coerce NTLM authentication.
This rule detects email-based phishing attempts that utilize a two-hop open-redirect mechanism by abusing legitimate SaaS platforms (holabrief.com and loopedin.io). It flags emails containing specific redirect links, often used to bypass traditional security filters by redirecting users through trusted domains before reaching a malicious destination.
Detects HTTP 3xx redirect chains where a browser is redirected to a cloud-native staging domain (such as azurewebsites.net, pages.dev, or web.app) that has not been previously observed in the organization's network traffic history over the last 37 days. This pattern is commonly used by adversaries to redirect traffic to staging infrastructure hosting malicious payloads or C2 content while leveraging reputable cloud services to bypass filters.
Identifies command-line arguments that involve both a Markdown (.md) file and a suspicious URI scheme. This could indicate an attempt to exploit CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Detects the installation of a malicious browser extension that impersonates the legitimate Perplexity AI service. The extension leverages a typosquatted domain ('perplexity-ai.online') and a specific extension ID to facilitate search hijacking and keystroke collection on the victim host.
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Detects suspicious command-line execution patterns where 'cmd.exe' is spawned by 'explorer.exe' (often indicative of .lnk file execution) and the command line contains specific arguments associated with malicious shortcut files. The rule looks for '/c start' and indicators of payload staging in Public Documents or removable drives, while excluding known benign system paths.
Identifies PDF readers spawning web browsers that navigate to intermediary Cloudflare/reCAPTCHA domains, which are often used to mask the actual phishing landing page in tax-related phishing campaigns.
Page 8 of 14