Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This query focuses on detecting the Brazilian banking trojan known as Maverick. This malware has recently gained attention due to its aggressive propagation methods, particularly through WhatsApp Web. By leveraging social engineering techniques, Maverick spreads malicious links and attachments disguised as legitimate messages, tricking users into executing harmful code. Once installed, the trojan is capable of intercepting banking credentials, manipulating transactions, and exfiltrating sensitive financial information. Detecting Maverick requires monitoring suspicious script executions, abnormal network traffic patterns, and unauthorized use of processes such as cscript.exe and wscript.exe, which are often abused by attackers to run malicious payloads. The query aims to identify indicators of compromise associated with Maverick’s activity, helping security teams mitigate its impact and protect users from financial fraud
This rule detects TLS connections to domains associated with Gh0st RAT impersonation campaigns, specifically 'Campaign Trio' and 'Campaign Chorus'. It looks for specific strings ('i4tools', 'youdao', 'deepseek') in the TLS Server Name Indication (SNI) field, combined with top-level domains like '.top' or '.vip'. This pattern indicates potential command and control (C2) communication from Gh0st RAT malware.
This rule detects network connections to external hosts exhibiting a specific JARM fingerprint (27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6) that has been associated with a phishing campaign, specifically targeting Harbor Freight. JARM fingerprints are used to identify unique TLS server configurations, and this particular hash indicates a known malicious infrastructure.
Thu rule focus in identity suspicious powershell commands execuded from the the windows "EXECUTE" box (WIN+R)
This rule detects emails or URL click events containing a specific pattern associated with 'quantum.php' within the URL. This pattern is often indicative of phishing attempts, particularly those designed to harvest credentials or deliver malware.
Detects phishing emails with malicious HTML attachments designed to harvest credentials and exfiltrate them via the Telegram Bot API. The detection looks for specific attachment filenames (e.g., RFQ, INQUIRY) or content patterns indicative of this threat.
Detects download of certain file types from hosts in suspicious TLDs
Detects executable downloads from suspicious remote systems
Detects strong indicators of a successful device code phishing attack.
Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.
Detects a spike in undeliverable emails, this can be an early indication of a targeted phishing campaign or a compromised user account.
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands. This technique is often used to bypass security controls that might inspect the command line for malicious strings.
Detects users who accessed Microsoft Copilot Studio and correlates that activity with OAuth consent events for third-party applications in Azure Active Directory. Optionally, it verifies whether the consented application was used to access data via Microsoft Graph API, indicating potential account compromise.
Detect the patten execution of the the brazilian malware Zapgrande
This rule detects when Okta FastPass successfully identifies and prevents an authentication attempt originating from a known phishing site. It specifically looks for Okta System Log events where the outcome reason is 'FastPass declined phishing attempt', the outcome result is 'FAILURE', and the event type is 'user.authentication.auth_via_mfa'. This indicates that a user attempted to authenticate via MFA, but Okta FastPass intervened due to a detected phishing attempt.
This rule detects a highly suspicious sequence of events: a user clicking on a URL (potentially a phishing link) followed by a risky sign-in attempt to Azure AD from an IP address outside the organization's defined range. The rule specifically looks for sign-ins with a high-risk level (>= 50) that occur after a URL click event, suggesting a potential compromise initiated by a phishing attack.
Detects a single Gmail sender address using multiple distinct display names within a short timeframe (1 hour). This behavior can indicate an attempt at impersonation, phishing, or spam campaigns where an attacker tries to appear as different entities from the same compromised or controlled email account.
Detected endpoints that processed an SVG file and subsequently connected to a known malicious domain.
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
This rule detects the creation of temporary files within the WebDAV TfsStore directory that have suspicious file extensions. Attackers can leverage WebDAV to force authentication or to drop malicious files onto a system. The presence of executable or archive file extensions in this specific temporary directory is highly indicative of malicious activity, potentially related to initial access or resource development.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Page 56 of 77