Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This rule detects suspicious sign-in activities that occur shortly after a network connection to an IP address associated with 'Lab539 Clickfix'. It correlates risky sign-in events from Azure Active Directory (AAD) with network connection logs from devices. Specifically, it looks for AAD sign-ins with a risk level of 30 or higher, from non-guest, non-compliant, and non-managed devices, where the IP address has not been seen for that user in the last 30 days. This is then joined with network connection events to IP addresses found in the 'Lab539 Clickfix' external data, ensuring the sign-in occurs after the network connection within a short timeframe. The 'Lab539 Clickfix' reference suggests a connection to a known threat or campaign, possibly related to phishing or credential compromise.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
The following analytic identifies potential phishing attempts blocked by Zscaler within a network. It leverages web proxy logs to detect actions tagged as HTML.Phish. The detection method involves analyzing critical data points such as user, threat name, URL, and hostname. This activity is significant for a SOC as it serves as an early warning system for phishing threats, enabling prompt investigation and mitigation. If confirmed malicious, this activity could indicate an attempt to deceive users into divulging sensitive information, potentially leading to data breaches or credential theft.
Detects a non-browser process launching a browser with automation flags, which subsequently connects to WhatsApp Web. This behavior is consistent with the Maverick banking trojan's use of Selenium and WPPConnect to hijack WhatsApp sessions for self-propagation.
This rule detects potential SVG-based phishing attempts originating from Microsoft Outlook. It correlates network access, file downloads, and URL click telemetry to identify instances where Outlook initiates connections to or downloads files ending with '.svg'. This is particularly relevant for detecting phishing campaigns that leverage malicious SVG files to embed JavaScript, redirectors, or Base64-encoded HTML payloads for credential harvesting or other malicious activities.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
This query detects URLs shared in Microsoft Teams messages, chats, or meetings that may represent potential security risks. It filters out internal domains, SharePoint URLs, placeholder links, and known system domains to focus specifically on unique external URLs being exchanged within the organization.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
This rule detects various activities associated with the InterLock Ransomware (UNC5774). It identifies anti-VM checks performed via PowerShell, specifically looking for commands that query for QEMU, memory less than 4GB or 1.5GB, or specific desktop naming conventions. It also detects local group and Service Principal Name (SPN) enumeration using PowerShell cmdlets like 'Get-LocalGroupMember', 'Get-LocalGroup', or ADSI queries for 'samAccountName' and 'servicePrincipalName'. Persistence mechanisms are covered by monitoring registry Run/RunOnce keys for entries that launch 'node' or 'php' executables. Furthermore, the rule looks for suspicious staging of 'node.exe' or 'php.exe' within the AppData\Roaming directory when initiated by PowerShell processes. The rule leverages 'DeviceProcessEvents', 'DeviceRegistryEvents', and 'DeviceEvents' (specifically PowerShellCommand action type) to capture these activities.
Identifies devices with vulnerable versions of popular password manager browser extensions installed and active. These versions are susceptible to credential theft via DOM manipulation by malicious web pages. Note:
This is potential for false positives; the exploit is Client-side, out of reach for traditional detection. The detection will only validate vulnerable versions for the following password manager vendors who have not remediated all the vulnerabilities in the report by researcher Marek Tóth.
This is potential for false positives; the exploit is Client-side, out of reach for traditional detection. The detection will only validate vulnerable versions for the following password manager vendors who have not remediated all the vulnerabilities in the report by researcher Marek Tóth.
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc., and connects to a web application over http(s). This could indicate a possible phishing attempt, where a malicious document is used to redirect a user to a malicious website.
Detects potential malicious email execution chains where Microsoft Outlook spawns suspicious child processes (e.g., powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
This rule detects phishing attempts by identifying emails containing URLs and endpoint network connections to domains known to be associated with phishing campaigns. It leverages an external Indicator of Compromise (IOC) list of phishing domains. The rule scans email events for inbound messages with URLs matching these domains and also monitors endpoint network events for successful connections or HTTP inspections to these malicious domains. The results from both email and endpoint sources are then combined to provide a correlated view of potential phishing activity.
This rule detects potential malware infections and command and control activity by correlating email, endpoint file, and network events with indicators of compromise (IOCs) sourced from an external OSINT feed. It specifically looks for SHA256 hashes in email attachments, domains and URLs in email links, MD5, SHA1, and SHA256 hashes of created files on endpoints, and IP addresses and domains in network connections (both direct and HTTP inspected connections). The rule aims to identify initial access, execution, and command and control phases of an attack, potentially involving Cloudflare Tunnels as suggested by the rule's title and the OSINT source.
here we go with another quick and dirty one to detect Phishing Urls in Emails listed on phishunt.io Feed.
Recommended Action move to Junk Mail Folder or Delete the Message
Recommended Action move to Junk Mail Folder or Delete the Message
This rule correlates Microsoft Defender for Endpoint (MDE) SmartScreen and Network Protection blocks with network activity logs. It specifically looks for instances where SmartScreenUrlWarning or ExploitGuardNetworkProtectionBlocked events occur due to 'CustomBlockList' or 'CustomPolicy' settings. The rule then joins these events with DeviceNetworkEvents to identify the associated URLs, remote IP addresses, and ports involved in the blocked network communication. The primary goal is to identify and provide context for network access attempts that are blocked by custom security policies, indicating potential malicious or unwanted website access.
This rule detects emails containing URLs that match domains identified as phishing domains by cert.pl. It joins email URL information with a regularly updated list of known malicious domains from cert.pl and then correlates these with email events to identify potential phishing attempts.
This KQL query is designed to enrich "Malicious URL Click" alerts by correlating them with user sign-in activity. It finds the affected accounts and then checks if they had a successful login from a new IP address around the time of the alert. The final output flags high-risk events where a user's URL click activity is immediately followed or preceded by a login from an IP they've never used before. This helps prioritize investigation into potentially compromised accounts.
Page 57 of 77