Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects potential AiTM or credential harvesting campaigns where a device visits known lure or redirect paths (such as specific domains or workers.dev paths) and subsequently accesses the Microsoft device code authentication page within a 15-minute window.
Detects potential AiTM or credential harvesting campaigns where a device visits known lure or redirect paths (such as specific domains or workers.dev paths) and subsequently accesses the Microsoft device code authentication page within a 15-minute window.
This rule monitors for various indicators of compromise (IOCs) including malicious domains, IP addresses, specific URI paths, file names, and file hashes. It aggregates telemetry from network, file, process, and certificate events to detect potential threats interacting with known bad infrastructure or executing suspicious files associated with malware campaigns.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects inbound phishing emails containing brand mentions for Signal, WhatsApp, or Telegram alongside lure phrases related to verification, 2FA, or device linking. The rule specifically filters for emails containing URLs while excluding messages originating from official domains associated with these services.
Detects inbound phishing emails containing brand mentions for Signal, WhatsApp, or Telegram alongside lure phrases related to verification, 2FA, or device linking. The rule specifically filters for emails containing URLs while excluding messages originating from official domains associated with these services.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
Device code authentication flow completed, followed by subsequent session activity from a different IP/user-agent, indicating token replay to an attacker-controlled client that bypasses MFA
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule detects various malicious indicators of compromise (IOCs) across multiple telemetry sources, including DNS queries, web network traffic, file executions, process creation, and email activity. It monitors for interactions with known malicious domains, URLs, file hashes, and specific sender email addresses to identify potential malware distribution or C2 activity.
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
Detects emails from free-mail domains (@mail.com or @outlook.com) that contain a specific malicious infrastructure indicator in the InternetMessageId or originate from a known suspicious IP address associated with TA419-style spoofing campaigns. This indicates the email was relayed through unauthorized infrastructure rather than the expected legitimate mail providers.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule monitors for various indicators of compromise (IOCs) including malicious domains, IP addresses, specific URI paths, file names, and file hashes. It aggregates telemetry from network, file, process, and certificate events to detect potential threats interacting with known bad infrastructure or executing suspicious files associated with malware campaigns.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
Page 4 of 77