Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects the execution of osascript to display a deceptive dialog box mimicking 'System Preferences' to harvest user passwords. This technique was observed being used by the Atomic Stealer (AMOS) malware.
This rule detects network connections or DNS queries to a list of domains identified as phishing campaign infrastructure. These domains are associated with a 'Signal Phishing Campaign' and are likely used for malicious purposes such as credential harvesting or malware distribution. The rule checks for these domains in `RemoteUrl` or `DestinationHost` fields across various network-related logs.
Detects network connections to phishing domains mimicking Windows 11 download pages used to distribute infostealer malware.
Detects high-impact phishing campaigns identified by Microsoft Defender for Office 365. Alerts when a campaign (CampaignName, CampaignId) targets 25 or more recipients (RecipientEmailAddress) within 48 hours, providing timestamp and message details (NetworkMessageId) for investigation.
Identifies network connections or DNS queries to known phishing domains mimicking Windows 11 update sites, which are used to distribute infostealer malware. These domains are highly specific to this campaign.
This rule identifies accounts receiving the most email and highest threat exposure by analyzing inbound email events. It counts total emails, delivered emails, junked emails, blocked emails, and specifically highlights emails with detected threats (Phish, Malware, Spam) that were successfully delivered to the user's inbox. The output is sorted to prioritize accounts with the highest number of delivered threats.
Detects potential spam campaigns originating from disposable or trial Jira Cloud instances with randomized subdomain names. The rule identifies emails from '.atlassian.net' domains where the subdomain is longer than 12 characters and contains a mix of letters and numbers, indicating a potentially randomized or disposable instance. It then alerts if more than 5 emails with the same subject are sent from such a suspicious subdomain.
Detects incoming emails from Atlassian Jira domains (atlassian.net) that contain suspicious link redirectors or known Traffic Distribution Systems (TDS) like Keitaro. This activity is associated with a campaign where threat actors abuse Jira's trusted domain to send spam and phishing emails.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
This rule detects emails originating from Atlassian Jira (specifically the .atlassian.net domain) that contain subject lines associated with a known spam campaign. The campaign uses various lures, including investment scams and online casinos, across multiple languages.
Archive or browser/Office recently opened then child process is executable from user temp or downloads. AI/crypto social engineering campaigns often use ZIP with double-extension executables.
Detects incoming emails from Atlassian Jira Cloud subdomains where the subject line matches known spam patterns used in a campaign abusing the service's reputation.
Domains that introduce substitutions, extra characters, or randomness (e.g., micr0soft, paypa1-secure) tend to have higher entropy than the original brand name. This increase in entropy is a useful signal for detecting typosquatting and brand impersonation attempts in phishing campaigns.
https://www.kaseya.com/blog/dkim-replay-attacks-apple-paypal-invoice-abuse/
This rule detects emails delivered to an inbox that contain URLs identified as malicious by OpenPhish, indicating a successful phishing attempt or delivery of a known malicious link.
This is a KQL script to automate investigation by full email address. This can be pitched as a workbook as well. Keep in mind all the extra stuff is there for automation, this doesn't need to be your day-to-day query. There's simpler stuff you can make it on the fly in a matter of seconds and give you similar results. This here is for extra information in case you need a single pane of glass.
This rule detects instances where users click on URLs from emails that impersonate 'DocMagic'. It specifically looks for emails with 'docmagic' in the sender display name or address, extracts URLs from these emails, and then identifies if any of these URLs were subsequently clicked by users. This indicates a potential successful phishing attempt related to the DocMagic impersonation campaign.
This rule detects potential phishing activity by identifying inbound emails from specific sender addresses that were not blocked by Microsoft Defender for Office (MDO), followed by network connections to a known malicious infrastructure associated with 'Tycoon2FA'. The rule first looks for unblocked emails from 'donotreply@docmagic.com' and 'noreply@frigoarrobba.com.br'. If such emails are found, it then checks for network connections to 'listener.facraivo.sa.com' within a 7-day window, indicating a potential compromise or user interaction with the phishing attempt.
Detects browser processes making direct network connections to known Large Language Model (LLM) API endpoints. This activity is unusual when originating from general user web browsing, as it may indicate a malicious website is using an LLM to dynamically generate and fetch malicious code (e.g., JavaScript for a phishing page) at runtime.
Of course you can get an easier version to simply search emails by subject, this is too verbose. But this is used to make a workbook that will display a set of information about the incident and give you the possibility to click on a button, generate this and visit the incident's page.
Detects a browser visiting a URL with phishing-related keywords, followed by a direct network connection to a known Large Language Model (LLM) API endpoint from the same device within a short time window. This correlated behavior is a strong indicator of the "runtime assembly" attack pattern, where a malicious page dynamically generates a phishing payload by calling an LLM service.
Page 53 of 77