Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
213 detections
Filters
Last updated
All Time
Detection languages
160
16
13
6
5
Contributors
37
34
31
28
25
Categories
166
59
39
36
23
Platforms
128
34
29
27
25
Products / Services
146
23
21
17
17
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
6
IDS Protocols
4
2
Detects external Microsoft Teams calls involving screen sharing and impersonation of trusted entities. This rule identifies high-risk credential theft or RAT installation vectors by filtering for calls where screen sharing occurs and the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or impersonates common trusted entities like 'microsoft', 'helpdesk', 'it.support', 'admin', 'security.team', 'apple', 'google', 'amazon', 'paypal', 'bank', etc.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects internal emails with subject or body content related to payroll information changes (e.g., direct deposit, bank account redirection) sent to HR or payroll-related email addresses or recipients. This behavior is indicative of internal Business Email Compromise (BEC) or an attempt by an attacker (or compromised insider) to facilitate payroll fraud.
This rule detects network connections, specifically DNS queries or URL hits, to the domain 'facture-in.pages.dev'. It also looks for specific, indicative language within the RemoteUrl often associated with credential harvesting or phishing landing pages (e.g., 'no_mouse', 'wrong_timezone', 'A verificar o acesso').
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
Detects HTTP traffic involving redirect chains from known Gmail URL shorteners (goo.gl, g.co, short.gy) that terminate at the identified credential-harvesting domain chongdaotang.net. This behavior is indicative of a phishing campaign designed to harvest user credentials through a multi-stage redirect.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects network traffic fetching device codes from the Kali365 backend, specifically targeting the '/api/device/start' or '/api/device/status/' endpoints. This activity is associated with the EvilTokens device code phishing kit.
Detects the execution of a local, polymorphic HTML file that contains AI-obfuscated JavaScript, followed by an HTTP POST request to an external server within a 5-minute window, indicating potential credential exfiltration.
Detects email-based phishing attempts impersonating Scotiabank where the sender display name contains 'Scotiabank' but the actual sending domain is not 'scotiabank.com'. The rule specifically looks for emails with SPF and DMARC pass but missing DKIM pass, combined with suspicious subject lines (e.g., 'interac', 'e-transfer', 'unauthorized') or specific IP addresses/GoDaddy infrastructure indicators, and targeting high-value recipients (CFO, finance, etc.). This pattern is consistent with compromised legitimate small-business domain abuse.
This rule detects emails where the sender's address contains keywords like 'paypal', 'amazon', or 'apple' but does not originate from their official domains (e.g., '@paypal.com'). This pattern is indicative of lookalike domain phishing attempts, where attackers try to impersonate legitimate brands to trick recipients.
Detects phishing emails leveraging Telephone-Oriented Attack Delivery (TOAD). These emails impersonate Scotiabank and use urgent themes regarding unauthorized $3,000 Interac e-Transfers to lure victims into calling an attacker-controlled toll-free number. The rule monitors for specific email subjects and attachments masquerading as voicemail audio files (v-mail*.mp3.eml or v-mail*.html).
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
Detects first-time external sender domains delivering multiple voicemail-themed or financial urgency emails to the same recipient during off-hours (midnight-06:00 UTC), consistent with Scotiabank TOAD callback phishing targeting CFO/finance executives.
Identifies successful device code authentications originating from non-trusted named locations. This can indicate an attempt to bypass multi-factor authentication or compromise an account through device code phishing.
Detects inbound emails masquerading as Scotiabank or Interac e-Transfer alerts that contain a specific attacker-controlled US toll-free number (1-800-472-XXXX). This pattern is indicative of a Telephone-Oriented Attack Delivery (TOAD) campaign targeting financial personnel.
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Page 5 of 11