Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,142 detections
Filters
Last updated
All Time
Detection languages
2,293
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,164
747
693
623
440
Platforms
39,960
7,270
6,537
3,868
3,651
3,142
Products / Services
2,850
742
269
187
182
MITRE Techniques
872
857
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects inbound emails with voicemail-themed subjects that pass SPF and DKIM but fail DMARC alignment. This technique is often used to exploit domains with p=none policies and obscure the actual origin of phishing attempts.
Detects Microsoft Teams messages containing links to Pastebin. Threat actors (e.g., Nimbus RAT operators) use Pastebin to host instruction checklists and payload URLs during vishing attacks.
This query is oriented to identify IOCs observed into different Security websites and reports with the aim to identify quickly possible attacks reported from different sources. The TI Feed used, is based on a Claude AI Agent running daily collecting the mentioned indicators from the different sources. Additional Info --> https://www.linkedin.com/pulse/use-ai-agents-enrich-generate-ti-feeds-based-security-sergio-albea-bxzze
This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.
This rule detects potential phishing attempts by identifying emails with URLs that originate from outside the internal company domain (@company.com). It specifically looks for emails where the subject line contains keywords like 'click', 'confirm', or 'update', and where multiple such emails (3 or more) are sent from the same external sender to the same recipient.
This rule detects a multi-stage attack chain associated with the Nimbus RAT, starting with a suspicious Microsoft Teams message (vishing) from an external sender using throwaway domains (e.g., .onmicrosoft.com, .top). This initial communication is then correlated with subsequent reconnaissance activities performed via Quick Assist, where QuickAssist.exe spawns cmd.exe to execute commands like 'net time', '/domain', 'whoami', 'ipconfig', or 'systeminfo' on the victim's device within a two-hour window. The rule aims to identify the internal victim and the external sender involved in this coordinated attack.
This rule detects potential 'reply-all' storm attacks or malicious mass emails sent to large distribution lists within the organization. It identifies emails sent to 50 or more recipients where the subject line contains phrases like 'reply all' or 'all members', originating from an internal company domain. The rule then counts such broadcast emails within one-hour bins to identify unusual activity.
KQL Query from file: Cloudflare Eviltokens: Gotta catch’em all
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
Detects high-confidence phishing emails that were successfully delivered to user inboxes or folders instead of being quarantined, where the message is identified as first contact and not explicitly allowed through user-level safe sender/domain overrides. The query enriches the email data with URL click telemetry from UrlClickEvents, allowing visibility into whether embedded URLs were clicked or not clicked, who clicked them, and when the click occurred. This detection is intended to identify potentially malicious phishing emails that bypassed preventive controls and provide recipient-level click insight to support triage, impact assessment, and response actions.
Detects the creation or modification of Exchange inbox rules used by Kali365 designed to suppress security alerts by moving, deleting, or marking as read emails containing specific keywords. This technique is often used by adversaries to hide their activities or prevent detection.
Identifies bursts or requests to high-value Microsoft Graph API discovery endpoints. Tycoon 2FA operators frequently perform automated burst reconnaissance against these endpoints post-compromise to map out roles, tenant relationships, mailbox settings, and contacts.
This rule detects attempts to disable Conditional Access Policies in Microsoft 365 via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' targeting the 'conditionalAccess/policies' endpoint. Such activity could indicate an attacker attempting to bypass security controls for persistence or privilege escalation.
This rule detects when a user adds mailbox permissions to three or more mailboxes within a one-hour window in Exchange Online. This behavior can indicate an adversary attempting to gain persistent access to multiple mailboxes, often for data exfiltration or further compromise.
This rule detects potential internal phishing campaigns by identifying newly observed sender domains that send emails to a large number of internal recipients within a short period. It looks for sender domains that have been seen for the first time within the last 7 days, have sent emails to more than 10 unique recipients, and have sent more than 5 emails in total. This behavior can indicate an attacker attempting to phish internal users from a newly created or compromised domain.
This rule detects potential phishing attempts impersonating Adobe Document Cloud. It looks for emails with subjects containing keywords like "Adobe", "Document Cloud", "Sign Document", or "View Document", but where the sender's domain is NOT a legitimate Adobe domain (adobe.com or documentcloud.adobe.com). The rule then counts these occurrences per sender address and domain over a daily period.
Detects inbound emails containing Mailchimp click-tracking links that redirect to ActiveCampaign landing pages, a known ESP chaining technique used to obscure credential harvesters. This technique is often used in phishing campaigns to bypass email security controls.
This rule detects inbound emails that appear to be Microsoft Teams invitations but contain suspicious keywords in the subject line related to financial transactions (invoice, billing, payment, renewal, charge). This could indicate a phishing attempt where adversaries leverage legitimate-looking Microsoft invitation emails to deliver financially themed lures.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
This rule detects potential 'reply-all' storm attacks or malicious mass emails sent to large distribution lists within the organization. It identifies emails sent to 50 or more recipients where the subject line contains phrases like 'reply all' or 'all members', originating from an internal company domain. The rule then counts such broadcast emails within one-hour bins to identify unusual activity.
Page 111 of 150