Enterprise Detection Intelligence Feed

This rule detects inbound emails with subjects and attachments themed around employee compensation, policy, or handbook updates, a common social engineering lure. It specifically flags emails containing Microsoft Word or PDF attachments with filenames that match keywords like 'salary', 'bonus', 'handbook', or 'update'. The detection logic correlates suspicious keywords in both the subject line and attachment filename and is intended to identify credential phishing attempts delivered via malicious documents. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566, T1566.001

credential-access malicious-activity TA0001 T1566 T1566.001 MIT License

The detection logic has been expanded to increase coverage. The rule now includes '.pdf' files in its attachment analysis, in addition to Microsoft Word documents. New keywords such as 'remuneration', 'details', and 'adjustment' have been added to the subject and filename checks. A new condition was also introduced to detect if an attachment filename contains the recipient's email address, a common tactic for personalizing lures.

This rule detects email-based brand impersonation attacks posing as Booking.com. It identifies inbound messages with a low number of links, topics related to travel or customer service, and mentions of "Booking.com". The detection logic triggers on signs of credential theft, suspicious links (mismatched display URLs, new domains, redirect paths), or specific intent phrases like "book a room". The rule ensures the sender is not from the legitimate "booking.com" domain and has a history of malicious/spam activity or no prior solicited communication. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566, T1036

credential-access malicious-activity TA0001 T1566 T1036 MIT License

The detection logic was expanded to improve coverage of Booking.com impersonation attempts. New conditions were added to check for "booking.com" in the sender's display name and to search the email body for intent-revealing phrases such as "book a room" or variations of "available". A minor formatting change was also made to an existing XPath check.

Identifies brute force attempts against Microsoft Entra ID multi-factor authentication (MFA) using Time-based One-Time Password (TOTP) codes. The rule triggers when a high number of failed TOTP code attempts from at least 10 distinct sessions are observed for a single user within a short time frame. This behavior is indicative of an adversary with valid primary credentials programmatically attempting to guess the MFA code to gain unauthorized access. Relevant MITRE ATT&CK tactics: TA0006 Relevant MITRE ATT&CK techniques: T1110, T1110.001, T1621

credential-access cloud-security identity-and-access-management TA0006 T1110 T1110.001 T1621 Elastic License 2.0

The rule was substantially updated to improve detection accuracy. The query logic was rewritten to filter on member user types, include an additional failure error code (500121), and now requires a high count of distinct session IDs (>=10) in addition to a high event count (>=20) per user. This refines the detection from a simple high-frequency count to a more specific brute-force pattern across multiple sessions. Metadata, including the rule name, description, and triage steps, were updated to reflect these changes.

This rule detects inbound emails with subjects related to compensation reviews (e.g., 'salary', 'bonus', 'raise') that also contain an attached EML file. The detection logic further inspects the attached EML's own attachments, triggering an alert if they contain a QR code or barcode, identified either through direct analysis or via OCR of scanned documents. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566, T1566.001

malicious-activity credential-access TA0001 T1566 T1566.001 MIT License

The detection logic was updated by replacing a regex match for 'update(d| to)' in the email subject with a broader and more performant string containment check for 'update'. This change simplifies the query and slightly expands detection coverage to include subjects containing only the root word 'update'.

This rule detects attempts to modify or delete critical Windows forensic artifacts, specifically the Amcache.hve file and the SYSTEM hive. The Amcache.hve file logs program execution details, while the SYSTEM hive contains the Shimcache, which tracks historical program activity. The query monitors for file events targeting `Amcache.hve` or the `SYSTEM` file within `C:\Windows\System32\config\`, as attackers may tamper with these files to erase evidence of their presence and actions on a compromised system. Relevant MITRE ATT&CK tactics: TA0005 Relevant MITRE ATT&CK techniques: T1070, T1070.004

defense-evasion endpoint-security TA0005 T1070 T1070.004