Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
2
2
2
1
1
Platforms
4
2
Products / Services
10,508
9,775
6,702
4,439
3,708
MITRE Techniques
2
1
1
1
1
Detects an internal/compromised mailbox sending phishing-style email to multiple employees, the technique CISA's red team used to gain initial workstation access via a trusted internal sender.
Detects authentication to a web application using default/built-in account credentials followed by outbound mail sent from an internal address — the technique CISA's red team used to send phishing email from a trusted internal identity.
Detects process execution shortly after a user clicks a malicious link delivered via spearphishing email, indicating successful initial-access payload execution.
Detects the drop of Gunra's static ransom note file R3ADM3.txt matched by exact filename and content signature, and exact-match usage of known Gunra ransom-negotiation email addresses.