Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
22
4
Contributors
19
6
1
Categories
26
20
5
4
Platforms
26
Products / Services
26
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
Detects the RejectDirectSend bypass (null SMTP envelope sender + internal-domain spoof). Tightened to require Microsoft's composite auth verdict OR all of SPF/DKIM/DMARC failing (vs. any one), excludes known-approved Direct Send relay IPs, and excludes likely-legitimate bulk/newsletter traffic via BulkComplaintLevel.
This rule detects potential phishing emails that successfully pass through to the mailbox despite failing SPF, DKIM, or DMARC authentication checks. It specifically flags emails that claim to originate from high-value vendor domains (e.g., DocuSign, Zoom, Adobe, RingCentral) but contain links to external domains that do not match the alleged sender's domain, which is a common indicator of brand impersonation or credential harvesting campaigns.
This rule detects potential phishing emails that successfully pass through to the mailbox despite failing SPF, DKIM, or DMARC authentication checks. It specifically flags emails that claim to originate from high-value vendor domains (e.g., DocuSign, Zoom, Adobe, RingCentral) but contain links to external domains that do not match the alleged sender's domain, which is a common indicator of brand impersonation or credential harvesting campaigns.
Page 2 of 2