Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This rule monitors for outbound network connections to domains and IP addresses associated with known phishing, loader, and C2 infrastructure, including specific ClickFix patterns.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
This rule detects known JavaScript payloads associated with the JWR phishing framework by matching their SHA-256 file hashes. This is a signature-based detection for malicious script files commonly used in phishing attacks.
Detects HTTP requests directed to the Vapi.ai API from potential phishing panels or malicious infrastructure. This behavior is indicative of an attacker leveraging Vapi.ai's conversational AI services to conduct automated voice phishing (vishing) campaigns by initiating calls or managing AI assistants.
Detects specific URI patterns associated with the 'JWR' phishing framework, which relays live operator instructions to capture pages (e.g., requesting CVV, 2FA codes, or PINs). These patterns are indicative of active adversary-in-the-middle phishing sessions.
This rule monitors DeviceNetworkEvents and DnsEvents for connections to known malicious domains and IP addresses associated with phishing campaigns. It alerts on any network communication or DNS resolution attempt targeting these indicators, providing visibility into potential user interaction with phishing infrastructure.
This rule monitors DeviceNetworkEvents and DnsEvents for connections to known malicious domains and IP addresses associated with phishing campaigns. It alerts on any network communication or DNS resolution attempt targeting these indicators, providing visibility into potential user interaction with phishing infrastructure.
This rule monitors DeviceNetworkEvents and DnsEvents for connections to known malicious domains and IP addresses associated with phishing campaigns. It alerts on any network communication or DNS resolution attempt targeting these indicators, providing visibility into potential user interaction with phishing infrastructure.
This rule detects phishing emails associated with the 'AnonyMousKIT' campaign that spoof Apple-related services ('Find My', 'Apple Support') using common adversary-controlled Gmail/iCloud addresses. The rule specifically targets institutional recipients in .gov, .edu, and .ac domains, identifying potential credential harvesting attempts despite the campaign's original consumer-focused pretext.
Detects phishing emails that impersonate Adobe Acrobat Sign or DocuSign using invoice or RFP-themed lures. The rule identifies suspicious emails by checking for brand-related keywords in the subject and display name, identifying links that do not lead to legitimate signing domains, and identifying senders that are impersonating a brand or are newly seen in the environment.
Detects phishing emails that impersonate Adobe Acrobat Sign or DocuSign using invoice or RFP-themed lures. The rule identifies suspicious emails by checking for brand-related keywords in the subject and display name, identifying links that do not lead to legitimate signing domains, and identifying senders that are impersonating a brand or are newly seen in the environment.
Detects phishing emails that impersonate Adobe Acrobat Sign or DocuSign using invoice or RFP-themed lures. The rule identifies suspicious emails by checking for brand-related keywords in the subject and display name, identifying links that do not lead to legitimate signing domains, and identifying senders that are impersonating a brand or are newly seen in the environment.
Detects phishing emails that impersonate Adobe Acrobat Sign or DocuSign using invoice or RFP-themed lures. The rule identifies suspicious emails by checking for brand-related keywords in the subject and display name, identifying links that do not lead to legitimate signing domains, and identifying senders that are impersonating a brand or are newly seen in the environment.
This rule detects high-confidence phishing emails that were delivered to either the Inbox or Junk folder. It explicitly filters out messages that have been explicitly allowed by organization-level policies, user-level actions, or specific safe-sender bypass mechanisms, ensuring the alert focuses on malicious emails that bypassed standard security filters without an authorized exception.
Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.
Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.
Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.
Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.
This rule detects a multi-stage phishing attack, often referred to as 'quishing'. It identifies incoming emails containing image (JPG, PNG) or PDF attachments that embed previously unseen URLs, correlated with a subsequent sign-in event from a mobile device by the same recipient, which is a common indicator of Adversary-in-the-Middle (AiTM) credential harvesting.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
Page 15 of 77