Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,226 detections
Filters
Last updated
All Time
Detection languages
1,119
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
167
Platforms
651
438
269
228
200
Products / Services
10,683
9,759
6,695
4,421
3,750
1,226
MITRE Techniques
264
259
234
217
209
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
This rule detects modifications to Group Policy Objects (GPO) or Microsoft Entra (formerly Azure AD) policies that weaken established security controls. For GPO, it monitors Event ID 5136 for changes to security-relevant attributes (e.g., disabling firewall or real-time monitoring) in Active Directory. For Entra, it monitors audit logs for administrative operations that reduce security posture, such as disabling MFA, lowering authentication trust, or deleting Conditional Access policies. It includes filters to exclude legitimate, documented change management activities.
This rule detects modifications to Group Policy Objects (GPO) or Microsoft Entra (formerly Azure AD) policies that weaken established security controls. For GPO, it monitors Event ID 5136 for changes to security-relevant attributes (e.g., disabling firewall or real-time monitoring) in Active Directory. For Entra, it monitors audit logs for administrative operations that reduce security posture, such as disabling MFA, lowering authentication trust, or deleting Conditional Access policies. It includes filters to exclude legitimate, documented change management activities.
Detects active phishing threat-intelligence indicators whose domain name uses one of the disposable TLDs observed across IronToll's 73+ rotating lookalike domains (.cfd, .sbs, .icu, .buzz, etc.). Scoped to the structured ThreatType classification only — dropped the free-text 'Description has phishing' fallback, since KQL's 'has' is a substring/token match with no negation awareness (e.g. a description stating an indicator is 'not related to phishing' would still match), which could pull in indicators unrelated to actual phishing activity.
Detects active phishing threat-intelligence indicators whose domain name uses one of the disposable TLDs observed across IronToll's 73+ rotating lookalike domains (.cfd, .sbs, .icu, .buzz, etc.). Scoped to the structured ThreatType classification only — dropped the free-text 'Description has phishing' fallback, since KQL's 'has' is a substring/token match with no negation awareness (e.g. a description stating an indicator is 'not related to phishing' would still match), which could pull in indicators unrelated to actual phishing activity.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
This rule monitors for interactions with a list of known malicious phishing domains across email ingestion, user click events, and device network activity. It identifies potential exposure to phishing campaigns by tracking domain matches in incoming email URLs, user-clicked links, and outbound device network connections.
This rule monitors for interactions with a list of known malicious phishing domains across email ingestion, user click events, and device network activity. It identifies potential exposure to phishing campaigns by tracking domain matches in incoming email URLs, user-clicked links, and outbound device network connections.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
This rule monitors for interactions with a list of known malicious phishing domains across email ingestion, user click events, and device network activity. It identifies potential exposure to phishing campaigns by tracking domain matches in incoming email URLs, user-clicked links, and outbound device network connections.
Detects a sequence of suspicious behaviors on a single host within a 1-hour window, indicative of an adversary establishing a foothold and preparing for malicious activity. The pattern involves: 1) System architecture discovery, 2) Downloading files from an external IP address, 3) Changing permissions of files in temporary directories (e.g., /tmp, /var/tmp, /dev/shm), and 4) Executing files directly from those same temporary directories.
Detects a sequence of suspicious behaviors on a single host within a 1-hour window, indicative of an adversary establishing a foothold and preparing for malicious activity. The pattern involves: 1) System architecture discovery, 2) Downloading files from an external IP address, 3) Changing permissions of files in temporary directories (e.g., /tmp, /var/tmp, /dev/shm), and 4) Executing files directly from those same temporary directories.
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule detects activity associated with known indicators of compromise (IOCs) related to European political targeting campaigns. It monitors network, email, and authentication logs for connections to specific malicious domains (including .onion addresses) and IP addresses. The rule spans multiple data sources, including device network events, Entra ID sign-in logs, cloud application events, and email communications.
Detects execution of rundll32.exe with command-line arguments involving 'DavWWWRoot' and external domains ('pf.ch' or 'verification.google'), which is characteristic of attempts to force remote WebDAV authentication or execute malicious code via network-hosted resources.
Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.
Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.
This rule monitors DNS and email traffic for domains ending in .shop that fuzzy-match against a predefined watchlist of corporate brand names. This behavior is commonly associated with phishing campaigns, brand impersonation, or typosquatting, where attackers use similar-looking domains to lure users into revealing sensitive information or credentials.
This rule monitors DNS and email traffic for domains ending in .shop that fuzzy-match against a predefined watchlist of corporate brand names. This behavior is commonly associated with phishing campaigns, brand impersonation, or typosquatting, where attackers use similar-looking domains to lure users into revealing sensitive information or credentials.
Detects inbound emails masquerading as reputable advisory firms (PwC or KPMG) using lookalike sender domains, combined with wire-transfer fraud phrases in the subject line. Correlates with identity logon telemetry for the same fraudulent WhatsApp Business phone number, enabling detection across both email and authentication channels. Note: message body content is not available in the EmailEvents schema, so fraud-phrase matching is subject-only.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
Page 28 of 59