Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This rule detects high-confidence phishing emails that were delivered to either the Inbox or Junk folder. It explicitly filters out messages that have been explicitly allowed by organization-level policies, user-level actions, or specific safe-sender bypass mechanisms, ensuring the alert focuses on malicious emails that bypassed standard security filters without an authorized exception.
This rule detects high-confidence phishing emails that were delivered to either the Inbox or Junk folder. It explicitly filters out messages that have been explicitly allowed by organization-level policies, user-level actions, or specific safe-sender bypass mechanisms, ensuring the alert focuses on malicious emails that bypassed standard security filters without an authorized exception.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
This rule detects potential Business Email Compromise (BEC) attempts where an attacker impersonates an executive (CEO, CFO, etc.) via email. It identifies emails where the Sender's display name suggests a high-level executive role, but the domain of the Reply-To address differs from the sender domain, which is a common indicator of a fraudulent routing attempt. The rule further narrows this down to emails with subject lines typical of financial-themed urgency or requests.
This rule monitors endpoint network events, file operations, and process executions for known malicious indicators (domains and file hashes) associated with Kremlin activity. It detects connections to suspicious remote domains and the existence or execution of specific malicious file hashes.
Detects phishing emails that impersonate DocuSign by containing both an .ics calendar file attachment and a link directing users to the Microsoft login OAuth authorization endpoint, often indicative of credential or token harvesting.
This rule detects internal network activity (DNS queries, network connections, and security logs) communicating with domains associated with the GhostCode phishing kit. These domains are typically used to host credential harvesting pages or phishing infrastructure.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects a malicious, trojanized Electron-based application masquerading as 'Claude Opus 5 Free Desktop'. The rule identifies specific artifacts embedded within the binary, such as GitHub repository paths, internal Electron loader scripts (snmc.js), and staging patterns associated with the RevStealer infostealer campaign attributed to the Water Curse threat actor.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
This rule detects phishing emails where the sender's display name impersonates well-known brands (e.g., Microsoft, DocuSign, Zoom) while using a non-official domain. It further correlates these suspicious senders with embedded URLs that either match the targeted brands' domains or contain patterns commonly associated with device code phishing or API verification workflows.
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
This rule detects high-volume, burst-pattern email distribution associated with a 'New VM Received' subject line, originating from non-authorized or non-corporate domains. This behavior is indicative of potential mass phishing or spam campaigns mimicking automated voicemail notifications.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
Detects incoming EXTERNAL emails containing subject lines indicative of meeting invitations or call records, which include external URLs pointing to non-standard or unverified cloud storage providers, combined with explicit remote-access/support solicitation language. Requiring the remote-access/support signal and excluding internal-to-internal mail narrows this to callback-phishing style lures rather than routine meeting correspondence.
Page 18 of 77