Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,599 detections
Filters
Last updated
All Time
Detection languages
1,152
134
65
63
53
Contributors
368
274
239
197
70
Categories
984
375
271
227
140
Platforms
872
506
164
160
149
Products / Services
950
298
134
113
108
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,599
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects ClickFix social engineering attacks where users are tricked into pasting and executing a malicious script from a fake CAPTCHA page. The technique results in a browser process spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe as a child process to launch the first-stage loader.
Detects emails containing attachments that mimic voicemail files (e.g., .mp3.eml) with an HTML content type, often used in phishing campaigns. The rule specifically looks for dual extensions, HTML content type, a specific file size range, and subject line keywords related to financial institutions or unauthorized activity, indicating a potential Scotiabank impersonation or similar financial lure.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
Detects EvilTokens phishing kit gate check requests to /api/device/gate/ used to identify and burn phishing pages for security researchers
Identifies network connections to algorithmically generated Cloudflare Workers domains used by Kali365, specifically targeting the `-s-account.workers.dev` format. This pattern is indicative of phishing campaigns, potentially for credential harvesting or token replay.
This rule detects potential exposure of API keys, tokens, or secrets within FTP directory listings. It specifically looks for network events on remote port 21 (FTP) where the 'RemoteUrl' contains keywords like 'api_key', 'apikey', 'token', 'secret', or 'key=' during a network signature inspection.
This rule detects the execution of known remote access tools (such as AnyDesk, TeamViewer, or RustDesk) that are spawned as child processes from common web browsers. It correlates process creation events with subsequent network connections by these tools to public IP addresses over specific ports commonly used by remote access software, within a 30-minute timeframe of the process start.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects network traffic fetching device codes from the Kali365 backend, specifically targeting the '/api/device/start' or '/api/device/status/' endpoints. This activity is associated with the EvilTokens device code phishing kit.
Detects phishing emails utilizing Kali365's hardcoded subject line templates impersonating file sharing services like SharePoint and DocuSign. The rule specifically looks for emails with subjects starting with "SharePoint - Document Shared:" or "DocuSign - Signature Required:" where the sender's domain is not microsoft.com or docusign.com, indicating a potential spoofing attempt.
This rule detects potential business email compromise (BEC) activity where a compromised mailbox is used to send internal phishing emails or fraudulent invoices to financial departments. It identifies emails sent internally with subjects containing keywords like 'Invoice', 'Payment', 'Wire Transfer', or 'Updated Account', and correlates them with email sending events from cloud applications.
Detects HTTP response bodies containing specific strings associated with the 'Montana Empire' phishing kit. This rule monitors for indicators that a web server is serving a phishing credential harvesting page.
This rule monitors network logs (proxy, web gateway, and DNS) to detect connections to a curated list of known malicious domains associated with phishing, credential harvesting, and malware delivery infrastructure.
This rule detects potentially malicious web content by identifying the use of randomized or specific combinations of CSS filters (saturate, hue-rotate, brightness, contrast) within HTML responses. These techniques are often used by attackers to obfuscate malicious content, such as phishing pages, from automated scanners and security filters. The rule also incorporates a check for unusually large JavaScript bundle sizes, which may indicate the presence of injected malicious scripts.
This rule monitors network and email gateway logs to detect activity related to the Bluekit Phishing-as-a-Service (PhaaS) platform. It identifies traffic to known Bluekit command-and-control or phishing domains, detects the presence of rrweb scripts often associated with session recording on phishing pages, alerts on brand-impersonation phishing pages using specific keyword combinations, and flags the presence of FortiBleed campaign lures.
This rule detects highly suspicious email attachments that mimic voicemail notifications, specifically targeting Scotiabank users. It identifies emails with attachments named like 'v-mail_*.mp3.eml' or ending with '.mp3.eml' where the attachment's MIME type is 'application/html'. The rule also looks for specific subject line keywords related to Scotiabank, Interac, e-Transfer, unauthorized activity, or a specific monetary value ('3,000'), and checks for an approximate file size of 6000-9000 bytes, consistent with known phishing lures.
Detects an inbound policy-themed PDF attachment whose extracted URLs lead to a sign-in, authentication, review, or acknowledgement workflow outside the organisation. This rule specifically looks for PDF attachments in emails where the subject contains terms like 'code of conduct', 'policy', 'compliance', or 'handbook', and the extracted URLs within the PDF contain keywords such as 'login', 'signin', 'auth', 'review', or 'acknowledge'.
This rule monitors inbound emails that exhibit signs of phishing, specifically looking for failures in email authentication protocols (DKIM, DMARC), the use of specific invoice-themed subject lines, and the inclusion of redirection links pointing to known third-party collaboration platforms (HolaBrief, LoopedIn). It also identifies cases where the sender's envelope domain differs from the header's 'From' domain, which is a common indicator of email spoofing used in identity-based attacks.
Detects inbound phishing emails that fail both DKIM and DMARC checks, contain invoice-themed subject lines, and include links pointing to known open-redirect infrastructure (holabrief.com or loopedin.io). This pattern is consistent with credential harvesting campaigns using multi-hop SaaS redirects.
Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.
Page 40 of 77