Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This rule detects network connections or DNS requests to domains specifically structured to impersonate MFA registration, passkey setup, or SSO login pages. These domain patterns are commonly associated with phishing campaigns intended to harvest credentials, session tokens, or bypass multi-factor authentication (AiTM phishing).
This rule correlates the receipt of a potential extortion-themed email (containing keywords related to ransom, bitcoin, or data leaks and mentioning cloud platforms like SharePoint, OneDrive, or Box) with a subsequent bulk access event of mail items by the same recipient using a specific client application identifier. This pattern is indicative of an attacker attempting to extort a user or organization following the unauthorized exfiltration or access of sensitive email data stored in cloud services.
This rule detects internal network activity (DNS queries, network connections, and security logs) communicating with domains associated with the GhostCode phishing kit. These domains are typically used to host credential harvesting pages or phishing infrastructure.
This rule monitors for indicators of compromise (IOCs) associated with Operation SideCopy, including specific file hashes, known command-and-control (C2) IP addresses, malicious domains, and URLs. It triggers on file creation, process execution, and network connections matching these known indicators.
This rule monitors for indicators of compromise (IOCs) associated with Operation SideCopy, including specific file hashes, known command-and-control (C2) IP addresses, malicious domains, and URLs. It triggers on file creation, process execution, and network connections matching these known indicators.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
Detects incoming emails processed by Rspamd that exhibit suspicious authentication header signatures. The rule identifies emails lacking DKIM, ARC, or user agent information while simultaneously showing a zero receive count, potentially indicating spoofed, unauthenticated, or malformed phishing attempts.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
This rule detects phishing emails where the sender's display name impersonates well-known brands (e.g., Microsoft, DocuSign, Zoom) while using a non-official domain. It further correlates these suspicious senders with embedded URLs that either match the targeted brands' domains or contain patterns commonly associated with device code phishing or API verification workflows.
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Detects high-volume API call patterns targeting Google Gemini/Vertex AI services originating from a small, coordinated set of user accounts. This behavior may indicate an automated actor cluster, such as those leveraging generative AI to rapidly generate content for phishing kits or other malicious purposes.
Detects downstream delivery of likely AI-paraphrased mass-produced lure content by identifying bursts of near-duplicate subject lines from newly-seen domains with auth failures.
Detects downstream delivery of likely AI-paraphrased mass-produced lure content by identifying bursts of near-duplicate subject lines from newly-seen domains with auth failures.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Detects bursts of AI-paraphrased, brand/executive-impersonating email lures delivered to the inbox: clusters near-duplicate subject-line variants from the same sending domain within a 6-hour window, and requires a corroborating signal (authentication failure or a sender domain first seen within the last 14 days) plus an ESP allow-list exclusion to avoid flagging legitimate bulk/newsletter mail. Maps to T1683 (Generate Content) as the downstream-delivery proxy for AI-generated lure content.
Page 14 of 77