Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
2
2
1
1
1
Platforms
39,169
6,860
6,378
3,772
3,516
4
Products / Services
2
2
1
1
MITRE Techniques
2
1
1
1
1
Detects email from a new hire (within 30 days of hire date) combining personal-crisis pretext language with an explicit request to use a personal or unmanaged device, corroborated by a non-compliant or untrusted device sign-in, consistent with PurpleDelta's device-substitution social-engineering pattern.
Detects email communications from a recently-created account (within 60 days of account creation) requesting redirection of payroll or business payments to a personal bank account under a fabricated 'bank account under review' pretext, consistent with PurpleDelta payment-fraud tradecraft.
Detects spearphishing email impersonating the CSIS 'Indo-Pacific Forecast 2026' invitation-only event lure, gated on CSIS branding/display name combined with a sender domain that does not match csis.org.
Detects phishing emails impersonating AI/LLM service providers that reference API keys or developer consoles and contain embedded URLs to login/signin/auth/console pages, consistent with token-jacking campaigns harvesting developer credentials.